Bug 879181 (CVE-2022-39379)

Summary:	app-admin/fluentd: remote code execution via crafted JSON payloads
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	major	CC:	ruby, williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2
Whiteboard:	C1 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-11-02 14:57:27 UTC

CVE-2022-39379:

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

Please bump to 1.15.3.