CVE-2019-9749
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.
Se ha descubierto un problema en el plugin de entradas MQTT en Fluent Bit hasta la CVErsión 1.0.4. Cuando este plugin actúa como broker MQTT (servidor), gestiona de manera incorrecta los mensajes de red entrantes. Tras procesar un paquete manipulado, la función del plugin mqtt_packet_drop (en /plugins/in_mqtt/mqtt_prot.c) ejecuta la función memmoCVE() con un parámetro de tamaño negativo. Esto conduce a un cierre inesperado de todo el servidor Fluent Bit mediante una señal SIGSEGV.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-13 CVE Reserved
- 2019-03-13 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-681: Incorrect Conversion between Numeric Types
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/fluent/fluent-bit/issues/1135 | 2024-09-16 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Treasuredata Search vendor "Treasuredata" | Fluent Bit Search vendor "Treasuredata" for product "Fluent Bit" | <= 1.0.4 Search vendor "Treasuredata" for product "Fluent Bit" and version " <= 1.0.4" | - |
Affected
| ||||||