CVE-2022-39379: 
Ruby vulnerability analysis and mitigation

A remote code execution (RCE) vulnerability identified as CVE-2022-39379 was discovered in Fluentd, affecting versions 1.13.2 through 1.15.3. The vulnerability was disclosed on November 2, 2022, and specifically impacts non-default configurations of Fluentd when the FLUENT_OJ_OPTION_MODE environment variable is explicitly set to 'object' (GitHub Advisory, NIST NVD).

The vulnerability stems from Fluentd's use of Oj as its JSON parser when installed. When Oj.load is used in object-mode, it allows the deserialization of arbitrary Ruby objects, which can lead to remote code execution. The vulnerability was introduced in version 1.13.2 when the FLUENT_OJ_OPTION_MODE configuration option was added. The issue is tracked as CWE-502 (Deserialization of Untrusted Data) (GitHub Security Lab).

When exploited, this vulnerability allows unauthenticated attackers to execute arbitrary code on the affected system through specially crafted JSON payloads. The impact is particularly severe as it enables remote code execution capabilities, though it's mitigated by the fact that it only affects non-default configurations (GitHub Advisory).

The vulnerability is exploitable when Fluentd is configured with FLUENT_OJ_OPTION_MODE set to 'object' and the Oj gem is installed. Proof-of-concept exploit code exists that demonstrates the ability to execute arbitrary commands on the affected system through specially crafted JSON payloads (GitHub Security Lab).

The vulnerability was patched in Fluentd version 1.15.3 by removing the 'object' option from the available list of FLUENT_OJ_OPTION_MODE values. For users unable to upgrade immediately, the recommended workaround is to avoid using FLUENT_OJ_OPTION_MODE=object in their configuration (GitHub Commit).