PT-2017-6846 · Elastic · Logstash

Published 2017-06-27 · Updated 2019-06-17 · CVE-2015-5378

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Logstash versions 1.4.x through 1.4.3 Logstash versions 1.5.x through 1.5.2

Description The issue allows remote attackers to read communications between Logstash Forwarder agent and Logstash server.

Recommendations For Logstash versions 1.4.x through 1.4.3, update to version 1.4.4 or later. For Logstash versions 1.5.x through 1.5.2, update to version 1.5.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-5378

Affected Products

Logstash

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-5378 · Security Note
• https://elastic.co/community/security · Vendor Advisory
• http://securityfocus.com/archive/1/536859/100/0/threaded · Note
• http://packetstormsecurity.com/files/132800/Logstash-1.5.2-SSL-TLS-FREAK.html · Note
• http://securityfocus.com/archive/1/536050/100/0/threaded · Note
• http://securityfocus.com/bid/76015 · Note