Update dependency fluentd to v1.15.3 [SECURITY] (release-2.9.x) - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
fluentd (source)	'1.14.2' -> '1.15.3'

---

fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

CVE-2022-39379 / GHSA-fppq-mj76-fpj2

More information

Details

Impact

A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable FLUENT_OJ_OPTION_MODE is explicitly set to object.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.

Patches

v1.15.3

Workarounds

Do not use FLUENT_OJ_OPTION_MODE=object.

References

• GHSL-2022-067

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2
• https://nvd.nist.gov/vuln/detail/CVE-2022-39379
• https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
• https://github.com/fluent/fluentd
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fluentd/CVE-2022-39379.yml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

fluent/fluentd (fluentd)

v1.15.3

Compare Source

Bug Fix

• Support glob for !include directive in YAML config format
  https://github.com/fluent/fluentd/pull/39173917
• Remove meaningless oj options
  https://github.com/fluent/fluentd/pull/39293929
• Fix log initializer to correctly create per-process files on Windows
  https://github.com/fluent/fluentd/pull/39393939
• out_file: Fix the multi-worker check with <worker 0-N> directive
  https://github.com/fluent/fluentd/pull/39423942

Misc

• Fix broken tests on Ruby 3.2
  https://github.com/fluent/fluentd/pull/38833https://github.com/fluent/fluentd/pull/3922ull/3922

v1.15.2

Compare Source

Enhancement

• Add a new system configuration enable_jit
  https://github.com/fluent/fluentd/pull/38573857

Bug Fix

• out_file: Fix append mode with --daemon flag
  https://github.com/fluent/fluentd/pull/38643864
• child_process: Plug file descriptor leak
  https://github.com/fluent/fluentd/pull/38443844

Misc

• Drop win32-api gem to support Ruby 3.2
  https://github.com/fluent/fluentd/pull/38493https://github.com/fluent/fluentd/pull/3866ull/3866

v1.15.1

Compare Source

Bug Fix

• Add support for concurrent append in out_file
  https://github.com/fluent/fluentd/pull/38083808

Misc

• in_tail: Show more information on skipping update_watcher
  https://github.com/fluent/fluentd/pull/38293829

v1.15.0

Compare Source

Enhancement

• in_tail: Add log throttling in files based on group rules
  https://github.com/fluent/fluentd/pull/35353https://github.com/fluent/fluentd/pull/3771ull/3771
• Add dump command to fluent-ctl
  https://github.com/fluent/fluentd/pull/36803680
• Handle YAML configuration format on configuration file
  https://github.com/fluent/fluentd/pull/37123712
• Add restart_worker_interval parameter in <system> directive to set
  interval to restart workers that has stopped for some reashttps://github.com/fluent/fluentd/pull/3768ull/3768

Bug fixes

• out_forward: Fix to update timeout of cached sockets
  https://github.com/fluent/fluentd/pull/37113711
• in_tail: Fix a possible crash on file rotation when follow_inodes true
  https://github.com/fluent/fluentd/pull/37543754
• output: Fix a possible crash of flush thread
  https://github.com/fluent/fluentd/pull/37553755
• in_tail: Fix crash bugs on Ruby 3.1 on Windows
  https://github.com/fluent/fluentd/pull/37663766
• in_tail: Fix a bug that in_tail cannot open non-ascii path on Windows
  https://github.com/fluent/fluentd/pull/37743774
• Fix a bug that fluentd doesn't release its own log file even after rotated by
  external tohttps://github.com/fluent/fluentd/pull/3782ull/3782

Misc

• in_tail: Simplify TargetInfo related code
  https://github.com/fluent/fluentd/pull/34893489
• Fix a wrong issue number in CHANGELOG
  https://github.com/fluent/fluentd/pull/37003700
• server helper: Add comments to linger_timeout behavior about Windows
  https://github.com/fluent/fluentd/pull/37013701
• service_discovery: Fix typo
  https://github.com/fluent/fluentd/pull/37243724
• test: Fix unstable tests and warnings
  https://github.com/fluent/fluentd/pull/37453https://github.com/fluent/fluentd/pull/3753uhttps://github.com/fluent/fluentd/pull/3767thttps://github.com/fluent/fluentd/pull/3783lhttps://github.com/fluent/fluentd/pull/3784nhttps://github.com/fluent/fluentd/pull/3785fhttps://github.com/fluent/fluentd/pull/3787com/test_child_process: Try to fix unstable tests fluent/fluentd#3787

v1.14.6

Compare Source

Enhancement

• Enable server plugins to specify socket-option SO_LINGER
  https://github.com/fluent/fluentd/pull/36443644
• Add --umask command line parameter
  https://github.com/fluent/fluentd/pull/36713https://github.com/fluent/fluentd/pull/3679ull/3679

Bug fixes

• Fix metric name typo
  https://github.com/fluent/fluentd/pull/36303https://github.com/fluent/fluentd/pull/3673ull/3673
• Apply modifications in pipeline to the records being passed to @ERROR label
  https://github.com/fluent/fluentd/pull/36313631
• Fix wrong calculation of retry interval
  https://github.com/fluent/fluentd/pull/36403https://github.com/fluent/fluentd/pull/3649uhttps://github.com/fluent/fluentd/pull/3685thttps://github.com/fluent/fluentd/pull/3686luentd/pull/3686
• Support IPv6 address for rpc_endpoint in system config
  https://github.com/fluent/fluentd/pull/36413641

Misc

• CI: Support Ruby 3.1 except Windows
  https://github.com/fluent/fluentd/pull/36193619
• Switch to GitHub Discussions
  https://github.com/fluent/fluentd/pull/36543654
• Fix CHANGELOG.md heading styles
  https://github.com/fluent/fluentd/pull/36483648
• Declare null_value_pattern as regexp
  https://github.com/fluent/fluentd/pull/36503650

v1.14.5

Compare Source

Enhancement

• Add support for "application/x-ndjson" to in_http
  https://github.com/fluent/fluentd/pull/36163616
• Add support for ucrt binary for Windows
  https://github.com/fluent/fluentd/pull/36133613

Bug fixes

• Don't retry when retry_max_times == 0
  https://github.com/fluent/fluentd/pull/36083608
• Fix hang-up issue during TLS handshake in out_forward
  https://github.com/fluent/fluentd/pull/36013601
• Bump up required ServerEngine to v2.2.5
  https://github.com/fluent/fluentd/pull/35993599
• Fix "invalid byte sequence is replaced" warning on Kubernetes
  https://github.com/fluent/fluentd/pull/35963596
• Fix "ArgumentError: unknown keyword: :logger" on Windows with Ruby 3.1
  https://github.com/fluent/fluentd/pull/35923592

v1.14.4

Compare Source

Enhancement

• in_tail: Add option to skip long lines (max_line_size)
  https://github.com/fluent/fluentd/pull/35653565

Bug fix

• Incorrect BufferChunkOverflowError when each event size is < chunk_limit_size
  https://github.com/fluent/fluentd/pull/35603560
• On macOS with Ruby 2.7/3.0, out_file fails to write events if append is true.
  https://github.com/fluent/fluentd/pull/35793579
• test: Fix unstable test cases
  https://github.com/fluent/fluentd/pull/35743https://github.com/fluent/fluentd/pull/3577ull/3577

v1.14.3

Compare Source

Enhancement

• Changed to accept http_parser.rb 0.8.0.
  http_parser.rb 0.8.0 is ready for Ractor.
  https://github.com/fluent/fluentd/pull/35443544

Bug fix

• in_tail: Fixed a bug that no new logs are read when
  enable_stat_watcher true and enable_watch_timer false is set.
  https://github.com/fluent/fluentd/pull/35413541
• in_tail: Fixed a bug that the beginning and initial lines are lost
  after startup when read_from_head false and path includes wildcard '*'.https://github.com/fluent/fluentd/pull/3542/3542
• Fixed a bug that processing messages were lost when
  BufferChunkOverflowError was thrown even though only a specific
  message size exceeds chunk_limihttps://github.com/fluent/fluentd/pull/3553thttps://github.com/fluent/fluentd/pull/3562luentd/pull/3562

Misc

• Bump up required version of win32-service gem.
  newer version is required to implement additional fluent-ctl commands.
  https://github.com/fluent/fluentd/pull/35563556

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.