ReDoS vulnerability in parser_apache2
Published: November 01, 2021
SECURITY IDENTIFIERS
- CVE: CVE-2021-41186 (NVD)
- GHSA: GHSA-hwhf-64mh-r662
- Vendor Advisory: https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662
GEM
SEVERITY
CVSS v3.x: 5.9 (Medium)
UNAFFECTED VERSIONS
< 0.14.14
PATCHED VERSIONS
>= 1.14.2
DESCRIPTION
Impact
parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack.
Patches
v1.14.2
Workarounds
Either of the following:
- Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache.
- Put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable
FLUENT_PLUGINor--pluginoption of fluentd).