CVE-2021-46878

Published on: Not Yet Published

Last Modified on: 04/26/2023 01:42:00 PM UTC

CVE-2021-46878

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Certain versions of Fluent Bit from Treasuredata contain the following vulnerability:

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file and trick the victim opening it using the affect software, triggering use-after-free and execute arbitrary code on the target system.

CVE-2021-46878 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 7.8 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
LOCAL	LOW	NONE	REQUIRED
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVE References

Description	Tags ^ⓘ	Link
27742 - oss-fuzz - OSS-Fuzz: Fuzzing the planet - Monorail	bugs.chromium.org text/html	MISC bugs.chromium.org/p/oss-fuzz/issues/detail?id=27742
pack: fix type confusion bugs. Amongst other OSS-Fuzz 5136174263566336 by DavidKorczynski · Pull Request #3115 · fluent/fluent-bit · GitHub	github.com text/html	MISC github.com/fluent/fluent-bit/pull/3115

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

906882 Common Base Linux Mariner (CBL-Mariner) Security Update for fluent-bit (26125-1)

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Treasuredata	Fluent Bit	1.7.1	All	All	All

cpe:2.3:a:treasuredata:fluent_bit:1.7.1:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2021-46878 : An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_t… twitter.com/i/web/status/1…	2023-04-11 18:11:08
@Robo_Alerts	Potentially Critical CVE Detected! CVE-2021-46878 An issue was discovered in Treasure Data Fluent Bit 1.7.1, errone… twitter.com/i/web/status/1…	2023-04-11 19:11:01