Insecure Randomness Affecting fluentd package, versions <0.14.12, >=0.14.5
Snyk CVSS
Attack Complexity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-FLUENTD-20372
- published 12 Jun 2017
- disclosed 29 Jan 2017
- credit Satoshi Moris Tagomori
How to fix?
Upgrade fluentd to version 0.14.12 or higher.
Overview
fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near real-time.
Affected versions of the package are vulnerable to Insecure Randomness. Random number generator used by OpenSSL produce predictable values and should not be used in security-sensitive context.