CVE-2025-12969

概要

参考情報

• fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0
• oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover

fluent bit のその他の脆弱性

• CVE-2025-12978中 5.4Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact…
• CVE-2025-12977緊急 9.1Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ab…
• CVE-2025-12972中 5.3Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugi…
• CVE-2025-12970高 8.8The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating leng…
• CVE-2024-50609高 7.5An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can…