SB2026083028 - openEuler 24.03 LTS SP3 update for rubygem-fluentd

Description

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-44024)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in the `${tag}` placeholder handling in file path configuration when processing log tags from untrusted sources. A remote attacker can inject path traversal sequences into a crafted tag to execute arbitrary code.

Exploitation requires the `${tag}` placeholder to be used in file-related configuration such as the `path` parameter, and certain formatting options can enable arbitrary file write or overwrite of existing files.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2026-44025)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authentication for critical function in the Monitor Agent API endpoints when handling HTTP requests to `/api/plugins.json` and related endpoints. A remote attacker can send a request to extract sensitive credentials used by other Fluentd plugins to disclose sensitive information.

The issue exposes internal instance variables of loaded plugins in plain text, and the impact depends on whether the Monitor Agent port is reachable and whether configured plugins store secrets in instance variables.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3538