Vulnerabilities > CVE-2019-9749 - Incorrect Conversion between Numeric Types vulnerability in Treasuredata Fluent BIT

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

treasuredata

CWE-681

NVD

Published: 2019-03-13

Updated: 2024-11-21

Summary

An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.

Vulnerable Configurations

Part	Description	Count
Application	Treasuredata Treasuredata Fluent BIT 0.1 Treasuredata Fluent BIT 0.2 Treasuredata Fluent BIT 0.3 Treasuredata Fluent BIT 0.4 Treasuredata Fluent BIT 0.5 Treasuredata Fluent BIT 0.5.1 Treasuredata Fluent BIT 0.6.0 Treasuredata Fluent BIT 0.7.0 Treasuredata Fluent BIT 0.7.1 Treasuredata Fluent BIT 0.7.2 Treasuredata Fluent BIT 0.8.0 Treasuredata Fluent BIT 0.8.1 Treasuredata Fluent BIT 0.8.2 Treasuredata Fluent BIT 0.8.3 Treasuredata Fluent BIT 0.8.4 Treasuredata Fluent BIT 0.8.5 Treasuredata Fluent BIT 0.9.0 Treasuredata Fluent BIT 0.9.1 Treasuredata Fluent BIT 0.10.0 Treasuredata Fluent BIT 0.10.1 Treasuredata Fluent BIT 0.11.0 Treasuredata Fluent BIT 0.11.1 Treasuredata Fluent BIT 0.11.2 Treasuredata Fluent BIT 0.11.3 Treasuredata Fluent BIT 0.11.4 Treasuredata Fluent BIT 0.11.5 Treasuredata Fluent BIT 0.11.6 Treasuredata Fluent BIT 0.11.7 Treasuredata Fluent BIT 0.11.8 Treasuredata Fluent BIT 0.11.9 Treasuredata Fluent BIT 0.11.10 Treasuredata Fluent BIT 0.11.11 Treasuredata Fluent BIT 0.11.12 Treasuredata Fluent BIT 0.11.13 Treasuredata Fluent BIT 0.11.14 Treasuredata Fluent BIT 0.11.15 Treasuredata Fluent BIT 0.11.16 Treasuredata Fluent BIT 0.11.17 Treasuredata Fluent BIT 0.12.0 Treasuredata Fluent BIT 0.12.1 Treasuredata Fluent BIT 0.12.2 Treasuredata Fluent BIT 0.12.3 Treasuredata Fluent BIT 0.12.4 Treasuredata Fluent BIT 0.12.5 Treasuredata Fluent BIT 0.12.6 Treasuredata Fluent BIT 0.12.7 Treasuredata Fluent BIT 0.12.8 Treasuredata Fluent BIT 0.12.9 Treasuredata Fluent BIT 0.12.10 Treasuredata Fluent BIT 0.12.11 Treasuredata Fluent BIT 0.12.12 Treasuredata Fluent BIT 0.12.13 Treasuredata Fluent BIT 0.12.14 Treasuredata Fluent BIT 0.12.15 Treasuredata Fluent BIT 0.12.16 Treasuredata Fluent BIT 0.12.17 Treasuredata Fluent BIT 0.12.18 Treasuredata Fluent BIT 0.12.19 Treasuredata Fluent BIT 0.13.0 Treasuredata Fluent BIT 0.13.1 Treasuredata Fluent BIT 0.13.2 Treasuredata Fluent BIT 0.13.3 Treasuredata Fluent BIT 0.13.4 Treasuredata Fluent BIT 0.13.5 Treasuredata Fluent BIT 0.13.6 Treasuredata Fluent BIT 0.13.7 Treasuredata Fluent BIT 0.13.8 Treasuredata Fluent BIT 0.14.0 Treasuredata Fluent BIT 0.14.1 Treasuredata Fluent BIT 0.14.2 Treasuredata Fluent BIT 0.14.3 Treasuredata Fluent BIT 0.14.4 Treasuredata Fluent BIT 0.14.5 Treasuredata Fluent BIT 0.14.6 Treasuredata Fluent BIT 0.14.7 Treasuredata Fluent BIT 0.14.8 Treasuredata Fluent BIT 0.14.9 Treasuredata Fluent BIT 1.0.0 Treasuredata Fluent BIT 1.0.1 Treasuredata Fluent BIT 1.0.2 Treasuredata Fluent BIT 1.0.3 Treasuredata Fluent BIT 1.0.4	82

Common Weakness Enumeration (CWE)

CWE-681 - Incorrect Conversion between Numeric Types

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References