CVE-2019-9749 — Incorrect Conversion between Numeric Types in Fluent BIT

CWE-681 — Incorrect Conversion between Numeric Types2 documents2 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 22.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Treasuredata Fluent BIT
Timeline
PublishedMar 13
Latest updateMay 13

Description

An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-8mpq-mw74-r6q5: An issue was discovered in the MQTT input plugin in Fluent Bit through 1↗2022-05-13
▶