From f5a0a0478310cc4bbee78ec401ffcf86c033c52c Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Mon, 8 Jul 2024 13:26:53 +0200 Subject: [PATCH] package/fluent-bit: security bump to version 2.2.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes the following security vulnerability: - CVE-2024-4323: A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution. https://fluentbit.io/announcements/v2.2.3/ Signed-off-by: Peter Korsgaard --- package/fluent-bit/fluent-bit.hash | 2 +- package/fluent-bit/fluent-bit.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/fluent-bit/fluent-bit.hash b/package/fluent-bit/fluent-bit.hash index 2c34583f7a..8916aeb0bd 100644 --- a/package/fluent-bit/fluent-bit.hash +++ b/package/fluent-bit/fluent-bit.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 8e7e951b2907e9d29508699c71c8949a4a22d750d54ffa5ee5b96537e59371dd fluent-bit-2.2.2.tar.gz +sha256 006ed94d34e4036fb7fb5a02016ccf3a55d7f5ccdefd5df756d1ba2206cfc55d fluent-bit-2.2.3.tar.gz sha256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594 LICENSE diff --git a/package/fluent-bit/fluent-bit.mk b/package/fluent-bit/fluent-bit.mk index 00a8904c55..b9bced5caf 100644 --- a/package/fluent-bit/fluent-bit.mk +++ b/package/fluent-bit/fluent-bit.mk @@ -4,7 +4,7 @@ # ################################################################################ -FLUENT_BIT_VERSION = 2.2.2 +FLUENT_BIT_VERSION = 2.2.3 FLUENT_BIT_SITE = $(call github,fluent,fluent-bit,v$(FLUENT_BIT_VERSION)) FLUENT_BIT_LICENSE = Apache-2.0 FLUENT_BIT_LICENSE_FILES = LICENSE