Search criteria ⓘ Use full-text search for keyword queries.
Combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by dates instead of relevance.

1 vulnerability by Cloud Native Computing Foundation (CNCF)

CVE-2017-10906 (GCVE-0-2017-10906)

Vulnerability from cvelistv5 – Published: 2017-12-08 15:00 – Updated: 2024-08-05 17:50
VLAI?
Summary
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Severity ?
No CVSS data available.
CWE
  • Escape Sequence Injection
Assigner
References
Impacted products
Vendor Product Version
Cloud Native Computing Foundation (CNCF) Fluentd Affected: 0.12.29 through 0.12.40
Create a notification for this product.
Date Public ?
2017-12-08 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.579Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2018:2225",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2225"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU95124098/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/fluent/fluentd/pull/1733"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Fluentd",
          "vendor": "Cloud Native Computing Foundation (CNCF)",
          "versions": [
            {
              "status": "affected",
              "version": "0.12.29 through 0.12.40"
            }
          ]
        }
      ],
      "datePublic": "2017-12-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escape Sequence Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-20T09:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "RHSA-2018:2225",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2225"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU95124098/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fluent/fluentd/pull/1733"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-10906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Fluentd",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "0.12.29 through 0.12.40"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cloud Native Computing Foundation (CNCF)"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escape Sequence Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2018:2225",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2225"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU95124098/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU95124098/index.html"
            },
            {
              "name": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes",
              "refsource": "CONFIRM",
              "url": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes"
            },
            {
              "name": "https://github.com/fluent/fluentd/pull/1733",
              "refsource": "CONFIRM",
              "url": "https://github.com/fluent/fluentd/pull/1733"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-10906",
    "datePublished": "2017-12-08T15:00:00.000Z",
    "dateReserved": "2017-07-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:50:12.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}