CVE-2021-41186

Katalog CVE

CVSS 7.5 · High EPSS 2,2%

Kerentanan Uncontrolled Resource Consumption pada fluentd. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

Rincian

Terbit di NVD

29 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142 release notes · advisory pihak ketiga
• https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662 advisory pihak ketiga
• https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_rep... broken link