PT-2017-6875 · Elastic · Logstash

Published 2017-08-09 · Updated 2019-06-17 · CVE-2015-5619

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Logstash versions 1.4.x through 1.4.4 Logstash versions 1.5.x through 1.5.3

Description The issue concerns the lack of validation of SSL/TLS certificates from the Logstash server when using Lumberjack output or the Logstash forwarder. This could allow attackers to intercept sensitive information via a man-in-the-middle attack.

Recommendations For Logstash versions 1.4.x through 1.4.4, update to version 1.4.5 or later. For Logstash versions 1.5.x through 1.5.3, update to version 1.5.4 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2015-5619

Affected Products

Logstash

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-5619 · Security Note
• https://elastic.co/blog/logstash-1-5-4-and-1-4-5-released · Vendor Advisory
• http://securityfocus.com/bid/76455 · Note
• http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html · Note
• http://securityfocus.com/archive/1/536858/100/0/threaded · Note
• http://securityfocus.com/archive/1/536294/100/0/threaded · Note