CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35963
https://notcve.org/view.php?id=CVE-2020-35963
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion. La función flb_gzip_compress en el archivo flb_gzip.c en Fluent Bit versiones anteriores a 1.6.4, presenta una escritura fuera de límites porque no usa el cálculo correcto de la expansión máxima de tamaño de datos gzip. • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261 https://fluentbit.io/announcements/v1.6.4 https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9749
https://notcve.org/view.php?id=CVE-2019-9749
An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal. Se ha descubierto un problema en el plugin de entradas MQTT en Fluent Bit hasta la CVErsión 1.0.4. • https://github.com/fluent/fluent-bit/issues/1135 • CWE-681: Incorrect Conversion between Numeric Types •