CVE-2019-9749

An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4

published March 13, 2019

CVSS
—
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01657 · 76.4th percentile
Published
2019-03-13T19:00Z
EPSS history
Timeline
  • 13 MAR 19:00Z
    An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4
    cvelistv5