Re: 5 CVE's fixed in Fluent Bit

[Christian Fischer <christian.fischer () greenbone net>]

On 12/2/25 4:56 PM, Christian Brabandt wrote:
> Well, I have asked upstream
> https://github.com/fluent/fluent-bit/issues/11230 and they have
> confirmed and updated the blog post[1] to mention 4.0.13 as the proper
> backported fix.
>
> I did not check or even verify the other versions.

Thanks a lot for the reference, this was a missing link so far.

As it only includes "I think it should be 4.0.13" and as i noticed that 
the linked blog post includes links to the relevant pull requests on 
GitHub i did a short own analysis here (also attached as plain text for 
archiving purposes):

https://github.com/fluent/fluent-bit/issues/11230#issuecomment-3606609133

My initial assumption/assessment is that four out of the five issues / 
CVEs are actually already fixed in 4.0.12 while one requires 4.0.13 for 
a "full" fix and 4.1.1 is currently still partly affected by that one.

I have forwarded this information to the Fluent Bit Security Team and 
asked them to publish official advisories for these CVEs as this could 
largely clear up some confusion / inconsistencies on the affected and 
fixed versions.

Attachment: fluentbit_analysis.txt
Description: