CVE-2017-10906

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

CVSS v3.0 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3.0 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://jvn.jp/en/vu/JVNVU95124098/index.html	Issue Tracking Third Party Advisory VDB Entry
https://github.com/fluent/fluentd/pull/1733	Issue Tracking Patch Third Party Advisory
https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes	Issue Tracking Release Notes Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2225	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fluentd:fluentd:0.12.31:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.33:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.40:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.35:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.36:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.37:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.38:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.29:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.30:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.32:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.34:::::::*
	cpe:2.3:a:fluentd:fluentd:0.12.39:::::::*

Configuration 2 (hide)

cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*

Information

Published : 2017-12-08 07:29

Updated : 2021-08-04 10:14

NVD link : CVE-2017-10906

Mitre link : CVE-2017-10906

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

fluentd

fluentd

redhat

openstack

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://jvn.jp/en/vu/JVNVU95124098/index.html", "name": "https://jvn.jp/en/vu/JVNVU95124098/index.html", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "https://github.com/fluent/fluentd/pull/1733", "name": "https://github.com/fluent/fluentd/pull/1733", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes", "name": "https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes", "tags": ["Issue Tracking", "Release Notes", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2225", "name": "RHSA-2018:2225", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-10906", "ASSIGNER": "vultures@jpcert.or.jp"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2017-12-08T15:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.35:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.36:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.37:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.38:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.29:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:fluentd:fluentd:0.12.39:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-08-04T17:14Z"}

9.8 /10