PT-2017-7673 · Elastic · Logstash

Published 2017-06-16 · Updated 2019-06-17 · CVE-2016-1000222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Logstash versions prior to 2.1.2

Description The issue allows an attack on the CSV output via engineered input, which can create malicious formulas in the CSV data.

Recommendations For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2016-1000222

Affected Products

Logstash

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-1000222 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1000222 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory