CVE-2017-10906 Fluentd Escape Sequence Injection Vulnerability
Attackers can inject escape sequences to execute arbitrary commands on devices running Fluentd, requiring an upgrade to secure the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-10906?
CVE-2017-10906 is a critical command injection vulnerability in Redhat Openstack, published on 8 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Which versions are affected by CVE-2017-10906?
2 open source packages ship an affected version, including fluentd. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
fluentd RubyGems | From 0.12.29 | 0.12.41 |
fluentd RubyGems | From 0.12.29 | 0.12.41 |
Linux distribution packages (1)
fluentd Red Hat:openstack-optools:13::el7 | All versions | 0:0.12.41-1.el7 |
Products include Fluentd Fluentd, Redhat Openstack.
How do I fix CVE-2017-10906?
Upgrade fluentd to 0.12.41 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-10906 being exploited?
There is no known exploitation of CVE-2017-10906 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
- CVE-2026-44024 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
- CVE-2020-21514 Fluent Fluentd and Fluent-ui use default password
- CVE-2026-44025 Fluentd: Exposure of Sensitive Information via Monitor Agent API
- CVE-2026-44160 Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
- CVE-2026-44161 Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
Sources
Also known as GHSA-5jrp-w8fr-mrww, RHSA-2018:2225.