The flaws tracked as CVE-2024-50608 and CVE-2024-50609 (CVSS 8.9), exploit null pointer dereference weaknesses in Fluent Bit’s Prometheus Remote Write and OpenTelemetry plugins. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Fluent Bit’s architecture amplifies risks by spanning input parsing, filtering, and output routing. This triggers a null pointer dereference in the process_payload_metrics_ng() function when parsing metrics data. As Tenable’s disclosure timeline shows, the industry’s collaborative patching effort, coordinated with AWS, Google, and Microsoft, prevented widespread exploitation. She is covering various cyber security incidents happening in the Cyber Space. Tenable’s lab tests confirmed adjacent memory exposure, occasionally revealing sensitive metrics data. Attackers exploiting these flaws could disrupt logging pipelines, paralyzing incident response and compliance workflows. With over 15 billion downloads and 10 million daily deployments, these vulnerabilities threaten global enterprise and cloud ecosystems. Similarly, the OpenTelemetry plugin fails to validate input types in trace configuration requests. Cisco, Splunk, and VMware are major users, while hyperscalers like AWS Elastic Kubernetes Service (EKS) embed it by default.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 24 Feb 2025 07:15:16 +0000