Skip to content
OpenAdvisories
Medium · 5.9 CVE-2021-41186 BIT-fluentd-2021-41186EUVD-2021-2358GHSA-hwhf-64mh-r662

ReDoS vulnerability in parser_apache2

Published Oct 29, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

Affected products

VendorProductAffectedFixed
fluent fluentd >= 0.14.14, < 1.14.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ruby3.2-rubygem-fluentd 1.15.3-1.4 openSUSE-SU-2024:13155-1
openSUSE Tumbleweed rubygem-fluentd 1.14.4-1.1 openSUSE-SU-2026:10346-1, openSUSE-SU-2025:15115-1, openSUSE-SU-2024:14072-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems fluentd >= 0.14.14, < 1.14.2 1.14.2 GHSA-hwhf-64mh-r662

Advisories 7

References