CVE-2024-4323 (tracing http monitoring api) does NOT impact aws-for-fluent-bit

[naoya7076]

### Describe the question/issue A memory corruption vulnerability was found in Fluent Bit versions 2.0.7 thru 3.0.3. Since it seems like version 1.9.10 is being used based on [this changelog](https://github.com/aws/aws-for-fluent-bit/blob/604204ecb9efdb06440cfea08d2c3e83adefc983/CHANGELOG.md?plain=1#L19), there might be no possibility of being affected. However, will aws-for-fluent-bit be impacted by this vulnerability? > Correct. As far as we know there is no impact to AWS for Fluent Bit. https://github.com/aws/aws-for-fluent-bit/issues/826#issuecomment-2125193123 ### Configuration

Fluent Bit Log Output

Fluent Bit Version Info

Cluster Details

Application Details

Steps to reproduce issue

Related Issues

https://www.cve.org/CVERecord?id=CVE-2024-4323

[PettitWesley]

AFAIK, this is correct. AWS for Fluent Bit uses 1.9.10 and is not impacted. The CVE was introduced when they introduced tracing support, and our distro has not released that feature yet.

https://www.tenable.com/security/research/tra-2024-17

[naoya7076]

Hi @PettitWesley , Thank you for your reply. Your response has resolved my concerns. I will now close this issue. Best regards,

[PettitWesley]

Keeping this open for a little while in case others have the same question

[arjunrk16]

@PettitWesley we are using stable version of aws-for-fluent-bit

public.ecr.aws/aws-observability/aws-for-fluent-bit:stable

I saw an article related to this which says

"The latest version of Fluent Bit, version 3.0.4, fixes this issue. We'd like to make sure you're aware of a security vulnerability (known as CVE-2024-4323) that impacts Fluent Bit versions 2.0. 7 through 3.0"

We are thinking to upgrade this now to 3.0.4 image, will this be resolving the issue ?

[dmitriy-drenkaliuk]

Would the image be impacted in the future when FluentBit version that it uses internally will be bumped? Or the impacted versions will be skipped?