Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Vulnerability - Action Required: Integer Overflow or Wraparound vulnerability may in your project #9368

Open
Crispy-fried-chicken opened this issue Sep 9, 2024 · 3 comments · May be fixed by #9369
Open

Security Vulnerability - Action Required: Integer Overflow or Wraparound vulnerability may in your project #9368

Crispy-fried-chicken opened this issue Sep 9, 2024 · 3 comments · May be fixed by #9369
Labels
status: waiting-for-triage

Comments

@Crispy-fried-chicken
Copy link

Crispy-fried-chicken commented Sep 9, 2024 •
edited
Loading

Hi,
we have detected that your project may be vulnerable to Integer Overflow or Wraparound in the function of parse_required_member in the file of lib/cmetrics/src/external/protobuf-c.c . It shares similarities to a recent CVE disclosure CVE-2022-48468 in the https://github.com/protobuf-c/protobuf-c.
The source vulnerability information is as follows:

Vulnerability Detail:
CVE Identifier: CVE-2022-48468
Description: protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-48468
Patch: protobuf-c/protobuf-c@ec3d900

Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!
@patrick-stephens
Copy link
Contributor

Please report security issues via the policy: https://github.com/fluent/fluent-bit/security/policy
This looks to be a medium level CVE related to the version of protobuf-c used by cmetrics so needs an update to cmetrics to resolve I think then pulled in here.

@leonardo-albertovich
Copy link
Collaborator

Hi @Crispy-fried-chicken, yes, we have verified that this bug has been fixed upstream and a PR that updates the relevant files in cmetrics would be welcome.

Thank you for taking the time to report this issue.

Crispy-fried-chicken added a commit to Crispy-fried-chicken/fluent-bit that referenced this issue Sep 9, 2024
@Crispy-fried-chicken
fix fluent#9368: unsigned integer overflow
8539cfc
@Crispy-fried-chicken Crispy-fried-chicken linked a pull request Sep 9, 2024 that will close this issue
Open
@Crispy-fried-chicken
Copy link
Author

Hi, @leonardo-albertovich I've already request a PR which is #9369, please review it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
status: waiting-for-triage
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix https://github.com/fluent/fluent-bit/issues/9368 Crispy-fried-chicken/fluent-bit
3 participants
@leonardo-albertovich @patrick-stephens @Crispy-fried-chicken