Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

An update of the rubygem package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS,
    Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd
    allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd
    setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to
    `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier
    versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a
    workaround do not use `FLUENT_OJ_OPTION_MODE=object`. (CVE-2022-39379)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-6b9e2a6534 advisory.

    golang-github-graylog2-gelf-2.0.0-5.20201111git1550ee6.fc37 was not in F37 because was override with     golang-github-graylog2-gelf-2.0.0-4.20190627git7ebf4f5.fc37


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rubygem-fluentd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-39379 advisory.

  - Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS,     Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd     allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd     setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to     `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier     versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a     workaround do not use `FLUENT_OJ_OPTION_MODE=object`. (CVE-2022-39379)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234753	Photon OS 4.0: Rubygem PHSA-2025-4.0-0783	Nessus	PhotonOS Local Security Checks	critical
233995	Photon OS 5.0: Rubygem PHSA-2025-5.0-0497	Nessus	PhotonOS Local Security Checks	critical
414621	SCA: security update for fluentd (GHSA-fppq-mj76-fpj2)	Tenable Cloud Security	SCA Checks	critical
414621	SCA: security update for fluentd (GHSA-fppq-mj76-fpj2)	Tenable Self-Hosted Container Security	SCA Checks	critical
194651	Fedora 37 : golang-github-docker / golang-github-graylog2-gelf (2023-6b9e2a6534)	Nessus	Fedora Local Security Checks	critical
172897	CBL Mariner 2.0 Security Update: rubygem-fluentd (CVE-2022-39379)	Nessus	MarinerOS Local Security Checks	critical

Detections

Analytics

CVE-2022-39379

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical