Fluent Bit version 3.1.10 vulnerabilities in ssp-infra

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

You find that Fluent Bit version 3.1.10 within the ssp-infra chart is being flagged for security vulnerabilities by compliance scanners. You require a non-vulnerable version to remediate these findings.

Environment

• Product: Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)
• Component: ssp-infra Helm chart
• Software: Fluent Bit 3.1.10

Cause

Fluent Bit version 3.1.10 contains known vulnerabilities that trigger security alerts. Version 5.0.7 is released with security hardening across input validation, compression safety, and protocol handling to address these concerns.

Resolution

This issue is targeted to be fixed in the ssp-infra chart version 4.0.4 and higher.

To remediate the vulnerabilities in your current environment, you have the following options:

Option 1: Manual Image Upgrade

You can manually upgrade the Fluent Bit image in your current deployment using the following Helm command:

helm upgrade <release_name> -n ssp <helm_repo_name>/ssp-infra --version=<chart_version> --reuse-values --set fluent-bit.image.tag=5.0.7

Option 2: Chart Upgrade

You can upgrade to the ssp-infra chart version 4.0.4 which includes the Fluent Bit 5.0.7 image by default.