May 23, 2024
On May 20, 2024, Tenable Research discovered a critical memory corruption vulnerability dubbed Linguistic Lumberjack in Fluent Bit (CVE-2024-4323), a core component in the monitoring infrastructure of many cloud services. Sumo Logic has updated all applicable systems to ensure we are not vulnerable and is continuing to monitor our corporate security posture as well as our third-party vendors to ensure they are dealing with the situation as appropriate.
From an open source perspective, although by default none of our solutions are exposed to the internet, some do leverage the impacted versions of Fluent Bit. We have released updated versions in those instances. See below for details.
Tailing sidecar operator version 0.13.0 contains the fix. Kubernetes Collection Helm Chart v4.7.1 contains the above fix. Kubernetes Collection Helm Chart v3.19.3 contains the above fix and a separate upgrade to Fluent Bit. No upgrades available for Kubernetes Collection Helm Chart version 2. Support for this version ended on 2023-07-20. Customers are encouraged to upgrade to v4.7.1. No upgrades available for Helm Operator. An upgrade to version 4 of the Helm Chart (where there’s no Fluent Bit) is in progress.
We will continue to monitor and update as appropriate.