Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@shoobhidoobi
Copy link
Contributor

@shoobhidoobi shoobhidoobi commented Oct 15, 2025

Problem

This fix addresses a local privilege escalation vulnerability in Datadog Agent versions 7.65.0-7.70.2 for Linux non-containerized hosts.

Vulnerability: CVSS 7.0 - Local privilege escalation
Affected Versions: 7.65.0 through 7.70.2
Fix Version: 7.71.1+
Our Current Version: 7.69.4 (vulnerable)

Impact
Affected Infrastructure:

Production: 20 EC2 instances running vulnerable agents

  • 10x postmangovsg-production-amz2 (main app server)
  • 10x postmangovsg-production-amz2-callback
    Staging: 2 EC2 instances (likely vulnerable)

All instances are part of Elastic Beanstalk environments with agent v7.69.4.

Solution

File: backend/.ebextensions/99datadog.config

  • Changed: DD_AGENT_MINOR_VERSION from "" (latest) to "71"
  • Effect: New EB instances will install Datadog Agent v7.71.x+ which contains the security fix
  • Added: Comments explaining the security patch

Copy link

@jwnicholas99 jwnicholas99 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, looks right according to the Datadog docs for Elastic Beanstalk

@shoobhidoobi shoobhidoobi merged commit 2fa4dc8 into master Oct 15, 2025
11 checks passed
@shoobhidoobi shoobhidoobi deleted the fix/dd-vulnerability branch October 15, 2025 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants