CVE-2017-10906

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://access.redhat.com/errata/RHSA-2018:2225	Third Party Advisory
https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes	Issue Tracking Release Notes Third Party Advisory
https://github.com/fluent/fluentd/pull/1733	Issue Tracking Patch Third Party Advisory
https://jvn.jp/en/vu/JVNVU95124098/index.html	Issue Tracking Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2225	Third Party Advisory
https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes	Issue Tracking Release Notes Third Party Advisory
https://github.com/fluent/fluentd/pull/1733	Issue Tracking Patch Third Party Advisory
https://jvn.jp/en/vu/JVNVU95124098/index.html	Issue Tracking Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fluentd:fluentd:0.12.29:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.30:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.31:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.32:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.33:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.34:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.35:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.36:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.37:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.38:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.39:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.40:::::::*

Configuration 2 (hide)

cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*

History

21 Nov 2024, 03:06

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/errata/RHSA-2018:2225 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2018:2225 - Third Party Advisory
References	~~() https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes - Issue Tracking, Release Notes, Third Party Advisory~~	() https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes - Issue Tracking, Release Notes, Third Party Advisory
References	~~() https://github.com/fluent/fluentd/pull/1733 - Issue Tracking, Patch, Third Party Advisory~~	() https://github.com/fluent/fluentd/pull/1733 - Issue Tracking, Patch, Third Party Advisory
References	~~() https://jvn.jp/en/vu/JVNVU95124098/index.html - Issue Tracking, Third Party Advisory, VDB Entry~~	() https://jvn.jp/en/vu/JVNVU95124098/index.html - Issue Tracking, Third Party Advisory, VDB Entry

Information

Published : 2017-12-08 15:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-10906

Mitre link : CVE-2017-10906

CVE.ORG link : CVE-2017-10906

JSON object : View

Products Affected

redhat

openstack

fluentd

fluentd

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-10906", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-12-08T15:29:00.260", "references": [{"url": "https://access.redhat.com/errata/RHSA-2018:2225", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes", "tags": ["Issue Tracking", "Release Notes", "Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://github.com/fluent/fluentd/pull/1733", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/vu/JVNVU95124098/index.html", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2225", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes", "tags": ["Issue Tracking", "Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/fluent/fluentd/pull/1733", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://jvn.jp/en/vu/JVNVU95124098/index.html", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de secuencias de escape en Fluentd en las versiones 0.12.29 hasta la 0.12.40 podr\u00eda permitir que un atacante cambie la interfaz de usuario del terminal o ejecute comandos arbitrarios en el dispositivo mediante vectores sin especificar."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.29:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E239F1C0-FF43-4BAA-9D5B-3B7E9FEA327C"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2086C8D1-DDC8-4074-95E5-82865839DCA2"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BC7FD40-1F7D-4A02-98DC-08A076DDD927"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.32:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93F62B56-8953-4EE8-94B8-64E354EC60D3"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABC5C48D-08B0-4477-AB11-168429985D3F"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46F12BEC-8EDE-47B2-ADBF-EAF5FDB56E19"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.35:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E27DE234-F139-4964-A0C2-6AFEB48E3712"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.36:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4257D676-4D0B-4470-BEA6-437CE56DF3FF"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35209FD8-F148-446B-8FE9-36AD908D9A91"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.38:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DCDBCBA-8F48-47E0-8E04-D69890CAC887"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.39:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D3BAA6D-4AB9-4323-A799-D5B2DAA65785"}, {"criteria": "cpe:2.3:a:fluentd:fluentd:0.12.40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D89D4AAD-EE06-4485-A2F7-04B8222B6968"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "704CFA1A-953E-4105-BFBE-406034B83DED"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}

9.8 /10