chore(deps): update dependency fluentd to v1.15.3 [security] (main) #10839
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
area/security
dependencies
kavirajk
approved these changes
Oct 10, 2023
rhnasc
pushed a commit
to inloco/loki
that referenced
this pull request
Apr 12, 2024
…rafana#10839) [](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [fluentd](https://www.fluentd.org/) ([source](https://togithub.com/fluent/fluentd)) | `'1.14.2'` -> `'1.15.3'` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2022-39379](https://togithub.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2) ### Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. ### Patches v1.15.3 ### Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`. ### References * GHSL-2022-067 --- ### Release Notes <details> <summary>fluent/fluentd (fluentd)</summary> ### [`v1.15.3`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1153---20221102) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.15.2...v1.15.3) ##### Bug Fix - Support glob for `!include` directive in YAML config format [fluent/fluentd#3917 - Remove meaningless oj options [fluent/fluentd#3929 - Fix log initializer to correctly create per-process files on Windows [fluent/fluentd#3939 - out_file: Fix the multi-worker check with `<worker 0-N>` directive [fluent/fluentd#3942 ##### Misc - Fix broken tests on Ruby 3.2 [fluent/fluentd#3883 ### [`v1.15.2`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1152---20220822) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.15.1...v1.15.2) ##### Enhancement - Add a new system configuration `enable_jit` [fluent/fluentd#3857 ##### Bug Fix - out_file: Fix append mode with `--daemon` flag [fluent/fluentd#3864 - child_process: Plug file descriptor leak [fluent/fluentd#3844 ##### Misc - Drop win32-api gem to support Ruby 3.2 [fluent/fluentd#3849 ### [`v1.15.1`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1151---20220727) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.15.0...v1.15.1) ##### Bug Fix - Add support for concurrent append in out_file [fluent/fluentd#3808 ##### Misc - in_tail: Show more information on skipping update_watcher [fluent/fluentd#3829 ### [`v1.15.0`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1150---20220629) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.14.6...v1.15.0) ##### Enhancement - in_tail: Add log throttling in files based on group rules [fluent/fluentd#3535 - Add `dump` command to fluent-ctl [fluent/fluentd#3680 - Handle YAML configuration format on configuration file [fluent/fluentd#3712 - Add `restart_worker_interval` parameter in `<system>` directive to set interval to restart workers that has stopped for some reas[fluent/fluentd#3768 ##### Bug fixes - out_forward: Fix to update timeout of cached sockets [fluent/fluentd#3711 - in_tail: Fix a possible crash on file rotation when `follow_inodes true` [fluent/fluentd#3754 - output: Fix a possible crash of flush thread [fluent/fluentd#3755 - in_tail: Fix crash bugs on Ruby 3.1 on Windows [fluent/fluentd#3766 - in_tail: Fix a bug that in_tail cannot open non-ascii path on Windows [fluent/fluentd#3774 - Fix a bug that fluentd doesn't release its own log file even after rotated by external to[fluent/fluentd#3782 ##### Misc - in_tail: Simplify TargetInfo related code [fluent/fluentd#3489 - Fix a wrong issue number in CHANGELOG [fluent/fluentd#3700 - server helper: Add comments to linger_timeout behavior about Windows [fluent/fluentd#3701 - service_discovery: Fix typo [fluent/fluentd#3724 - test: Fix unstable tests and warnings [fluent/fluentd#3745 ### [`v1.14.6`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1146---20220331) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.14.5...v1.14.6) ##### Enhancement - Enable server plugins to specify socket-option `SO_LINGER` [fluent/fluentd#3644 - Add `--umask` command line parameter [fluent/fluentd#3671 ##### Bug fixes - Fix metric name typo [fluent/fluentd#3630 - Apply modifications in pipeline to the records being passed to `@ERROR` label [fluent/fluentd#3631 - Fix wrong calculation of retry interval [fluent/fluentd#3640 - Support IPv6 address for `rpc_endpoint` in `system` config [fluent/fluentd#3641 ##### Misc - CI: Support Ruby 3.1 except Windows [fluent/fluentd#3619 - Switch to GitHub Discussions [fluent/fluentd#3654 - Fix CHANGELOG.md heading styles [fluent/fluentd#3648 - Declare `null_value_pattern` as `regexp` [fluent/fluentd#3650 ### [`v1.14.5`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1145---20220209) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.14.4...v1.14.5) ##### Enhancement - Add support for "application/x-ndjson" to `in_http` [fluent/fluentd#3616 - Add support for ucrt binary for Windows [fluent/fluentd#3613 ##### Bug fixes - Don't retry when `retry_max_times == 0` [fluent/fluentd#3608 - Fix hang-up issue during TLS handshake in `out_forward` [fluent/fluentd#3601 - Bump up required ServerEngine to v2.2.5 [fluent/fluentd#3599 - Fix "invalid byte sequence is replaced" warning on Kubernetes [fluent/fluentd#3596 - Fix "ArgumentError: unknown keyword: :logger" on Windows with Ruby 3.1 [fluent/fluentd#3592 ### [`v1.14.4`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1144---20220106) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.14.3...v1.14.4) ##### Enhancement - `in_tail`: Add option to skip long lines (`max_line_size`) [fluent/fluentd#3565 ##### Bug fix - Incorrect BufferChunkOverflowError when each event size is < `chunk_limit_size` [fluent/fluentd#3560 - On macOS with Ruby 2.7/3.0, `out_file` fails to write events if `append` is true. [fluent/fluentd#3579 - test: Fix unstable test cases [fluent/fluentd#3574 ### [`v1.14.3`](https://togithub.com/fluent/fluentd/blob/HEAD/CHANGELOG.md#Release-v1143---20211126) [Compare Source](https://togithub.com/fluent/fluentd/compare/v1.14.2...v1.14.3) ##### Enhancement - Changed to accept `http_parser.rb` 0.8.0. `http_parser.rb` 0.8.0 is ready for Ractor. [fluent/fluentd#3544 ##### Bug fix - in_tail: Fixed a bug that no new logs are read when `enable_stat_watcher true` and `enable_watch_timer false` is set. [fluent/fluentd#3541 - in_tail: Fixed a bug that the beginning and initial lines are lost after startup when `read_from_head false` and path includes wildcard '\*'.[fluent/fluentd#3542 - Fixed a bug that processing messages were lost when BufferChunkOverflowError was thrown even though only a specific message size exceeds chunk_limi[fluent/fluentd#3553 ##### Misc - Bump up required version of `win32-service` gem. newer version is required to implement additional `fluent-ctl` commands. [fluent/fluentd#3556 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/grafana/loki). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy44LjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
](https://renovatebot.com){kind=link}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
'1.14.2'->'1.15.3'GitHub Vulnerability Alerts
CVE-2022-39379
Impact
A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.
Fluentd setups are only affected if the environment variable
FLUENT_OJ_OPTION_MODEis explicitly set toobject.Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.
Patches
v1.15.3
Workarounds
Do not use
FLUENT_OJ_OPTION_MODE=object.References
Release Notes
fluent/fluentd (fluentd)
v1.15.3Compare Source
Bug Fix
!includedirective in YAML config formathttps://github.com/fluent/fluentd/pull/39173917
https://github.com/fluent/fluentd/pull/39293929
https://github.com/fluent/fluentd/pull/39393939
<worker 0-N>directivehttps://github.com/fluent/fluentd/pull/39423942
Misc
https://github.com/fluent/fluentd/pull/38833https://github.com/fluent/fluentd/pull/3922ull/3922
v1.15.2Compare Source
Enhancement
enable_jithttps://github.com/fluent/fluentd/pull/38573857
Bug Fix
--daemonflaghttps://github.com/fluent/fluentd/pull/38643864
https://github.com/fluent/fluentd/pull/38443844
Misc
https://github.com/fluent/fluentd/pull/38493https://github.com/fluent/fluentd/pull/3866ull/3866
v1.15.1Compare Source
Bug Fix
https://github.com/fluent/fluentd/pull/38083808
Misc
https://github.com/fluent/fluentd/pull/38293829
v1.15.0Compare Source
Enhancement
https://github.com/fluent/fluentd/pull/35353https://github.com/fluent/fluentd/pull/3771ull/3771
dumpcommand to fluent-ctlhttps://github.com/fluent/fluentd/pull/36803680
https://github.com/fluent/fluentd/pull/37123712
restart_worker_intervalparameter in<system>directive to setinterval to restart workers that has stopped for some reashttps://github.com/fluent/fluentd/pull/3768ull/3768
Bug fixes
https://github.com/fluent/fluentd/pull/37113711
follow_inodes truehttps://github.com/fluent/fluentd/pull/37543754
https://github.com/fluent/fluentd/pull/37553755
https://github.com/fluent/fluentd/pull/37663766
https://github.com/fluent/fluentd/pull/37743774
external tohttps://github.com/fluent/fluentd/pull/3782ull/3782
Misc
https://github.com/fluent/fluentd/pull/34893489
https://github.com/fluent/fluentd/pull/37003700
https://github.com/fluent/fluentd/pull/37013701
https://github.com/fluent/fluentd/pull/37243724
https://github.com/fluent/fluentd/pull/37453https://github.com/fluent/fluentd/pull/3753uhttps://github.com/fluent/fluentd/pull/3767thttps://github.com/fluent/fluentd/pull/3783lhttps://github.com/fluent/fluentd/pull/3784nhttps://github.com/fluent/fluentd/pull/3785fhttps://github.com/fluent/fluentd/pull/3787com/test_child_process: Try to fix unstable tests fluent/fluentd#3787
v1.14.6Compare Source
Enhancement
SO_LINGERhttps://github.com/fluent/fluentd/pull/36443644
--umaskcommand line parameterhttps://github.com/fluent/fluentd/pull/36713https://github.com/fluent/fluentd/pull/3679ull/3679
Bug fixes
https://github.com/fluent/fluentd/pull/36303https://github.com/fluent/fluentd/pull/3673ull/3673
@ERRORlabelhttps://github.com/fluent/fluentd/pull/36313631
https://github.com/fluent/fluentd/pull/36403https://github.com/fluent/fluentd/pull/3649uhttps://github.com/fluent/fluentd/pull/3685thttps://github.com/fluent/fluentd/pull/3686luentd/pull/3686
rpc_endpointinsystemconfighttps://github.com/fluent/fluentd/pull/36413641
Misc
https://github.com/fluent/fluentd/pull/36193619
https://github.com/fluent/fluentd/pull/36543654
https://github.com/fluent/fluentd/pull/36483648
null_value_patternasregexphttps://github.com/fluent/fluentd/pull/36503650
v1.14.5Compare Source
Enhancement
in_httphttps://github.com/fluent/fluentd/pull/36163616
https://github.com/fluent/fluentd/pull/36133613
Bug fixes
retry_max_times == 0https://github.com/fluent/fluentd/pull/36083608
out_forwardhttps://github.com/fluent/fluentd/pull/36013601
https://github.com/fluent/fluentd/pull/35993599
https://github.com/fluent/fluentd/pull/35963596
https://github.com/fluent/fluentd/pull/35923592
v1.14.4Compare Source
Enhancement
in_tail: Add option to skip long lines (max_line_size)https://github.com/fluent/fluentd/pull/35653565
Bug fix
chunk_limit_sizehttps://github.com/fluent/fluentd/pull/35603560
out_filefails to write events ifappendis true.https://github.com/fluent/fluentd/pull/35793579
https://github.com/fluent/fluentd/pull/35743https://github.com/fluent/fluentd/pull/3577ull/3577
v1.14.3Compare Source
Enhancement
http_parser.rb0.8.0.http_parser.rb0.8.0 is ready for Ractor.https://github.com/fluent/fluentd/pull/35443544
Bug fix
enable_stat_watcher trueandenable_watch_timer falseis set.https://github.com/fluent/fluentd/pull/35413541
after startup when
read_from_head falseand path includes wildcard '*'.https://github.com/fluent/fluentd/pull/3542/3542BufferChunkOverflowError was thrown even though only a specific
message size exceeds chunk_limihttps://github.com/fluent/fluentd/pull/3553thttps://github.com/fluent/fluentd/pull/3562luentd/pull/3562
Misc
win32-servicegem.newer version is required to implement additional
fluent-ctlcommands.https://github.com/fluent/fluentd/pull/35563556
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.