package/fluent-bit: security bump to 4.2.0

This is a major release that introduces new features,
including one highlighted in the release notes:

"The v4.2 release introduces a powerful new Direct Routing
 capability that allows inputs to specify routes directly to
 outputs, bypassing the traditional routing mechanism."

But it also brings some security fixes. Not all of them are relevant,
but some piece of lecture can be found here [1]. It fixes the
following CVEs:

CVE-2025-12977
CVE-2025-12978
CVE-2025-12972
CVE-2025-12970
CVE-2025-12969

News:
- https://fluentbit.io/announcements/v4.1.0/
- https://fluentbit.io/announcements/v4.1.1/
- https://fluentbit.io/announcements/v4.2.0/

The patch 0001-plugins-kafka-fix-cmake-cross-compile-error.patch
can be dropped as it has been merged upstream [2].

[1] https://www.theregister.com/2025/11/24/fluent_bit_cves/
[2] https://github.com/fluent/fluent-bit/pull/9600

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Thomas Devoogdt
2025-12-07 21:17:05 +01:00
committed by Thomas Petazzoni
parent 285097051d
commit 7a037d0913
4 changed files with 3 additions and 50 deletions

View File

@@ -1,4 +1,4 @@
From c33d6bd392c5c8bbd231b2a9d00d4959cc553c44 Mon Sep 17 00:00:00 2001
From 7329316bdcc72aceb6bbbdf8711f5bf8894c2a15 Mon Sep 17 00:00:00 2001
From: Thomas Devoogdt <thomas.devoogdt@barco.com>
Date: Tue, 25 Jul 2023 09:10:41 +0200
Subject: [PATCH] lib: librdkafka: only require a C compiler

View File

@@ -1,47 +0,0 @@
From a21de9cb95f2199270a6ac6922ffa4ca8d453f26 Mon Sep 17 00:00:00 2001
From: Thomas Devoogdt <thomas@devoogdt.com>
Date: Sat, 16 Nov 2024 19:46:28 +0100
Subject: [PATCH] plugins: kafka: fix cmake cross compile error
KAFKA_INCLUDEDIR is not set if FLB_PREFER_SYSTEM_LIB_KAFKA is not used,
when cross-compiling, it just translates to -I/librdkafka, which is not allowed.
Fix this by only including KAFKA_INCLUDEDIR if really set.
x86_64-linux-gcc: ERROR: unsafe header/library path used in cross-compilation: '-I/librdkafka'
Upstream: https://github.com/fluent/fluent-bit/pull/9600
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
---
plugins/in_kafka/CMakeLists.txt | 4 +++-
plugins/out_kafka/CMakeLists.txt | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/plugins/in_kafka/CMakeLists.txt b/plugins/in_kafka/CMakeLists.txt
index 928266b57..dc251276e 100644
--- a/plugins/in_kafka/CMakeLists.txt
+++ b/plugins/in_kafka/CMakeLists.txt
@@ -3,5 +3,7 @@ set(src
)
FLB_PLUGIN(in_kafka "${src}" ${KAFKA_LIBRARIES} flb-aws)
-target_include_directories(flb-plugin-in_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka)
+if(DEFINED KAFKA_INCLUDEDIR)
+ target_include_directories(flb-plugin-in_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka)
+endif()
target_link_libraries(flb-plugin-in_kafka -lpthread)
diff --git a/plugins/out_kafka/CMakeLists.txt b/plugins/out_kafka/CMakeLists.txt
index 9d8b34642..1c967329f 100644
--- a/plugins/out_kafka/CMakeLists.txt
+++ b/plugins/out_kafka/CMakeLists.txt
@@ -5,5 +5,7 @@ set(src
kafka.c)
FLB_PLUGIN(out_kafka "${src}" ${KAFKA_LIBRARIES} flb-aws)
-target_include_directories(flb-plugin-out_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka)
+if(DEFINED KAFKA_INCLUDEDIR)
+ target_include_directories(flb-plugin-out_kafka PUBLIC ${KAFKA_INCLUDEDIR}/librdkafka)
+endif()
target_link_libraries(flb-plugin-out_kafka -lpthread)
--
2.43.0

View File

@@ -1,3 +1,3 @@
# Locally computed
sha256 0031f74b616b4669064a59902559da2f87174aa8007e749b5df19ed79c534f5b fluent-bit-4.0.9.tar.gz
sha256 44fe0f52e89a63b213695748f99691d0a6247a4bd05065f1b517c798d9f89bcc fluent-bit-4.2.0.tar.gz
sha256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594 LICENSE

View File

@@ -4,7 +4,7 @@
#
################################################################################
FLUENT_BIT_VERSION = 4.0.9
FLUENT_BIT_VERSION = 4.2.0
FLUENT_BIT_SITE = $(call github,fluent,fluent-bit,v$(FLUENT_BIT_VERSION))
FLUENT_BIT_LICENSE = Apache-2.0
FLUENT_BIT_LICENSE_FILES = LICENSE