CyberRota Analysis
AI-GeneratedThe in_s3 input plugin of fluent-plugin-s3, versions 0.7.0 to 1.8.4, is vulnerable to a denial-of-service condition due to the lack of a decompression size limit, allowing an attacker to upload highly compressed objects that can exhaust memory when processed. This can lead to the termination of the Fluentd process, disrupting log collection on the affected node. Organizations using these versions of fluent-plugin-s3 should prioritize upgrading to version 1.8.5 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3 bucket can provide a highly compressed object that expands excessively when Fluentd processes it. The resulting memory exhaustion can cause the operating system to terminate the Fluentd process and disrupt all log collection on the affected node. This issue is fixed in version 1.8.5.