PT-2017-7879 · Elastic · Logstash

Published 2017-06-16 · Updated 2019-10-09 · CVE-2016-10363

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Logstash versions prior to 2.3.3

Description A denial of service attack can be performed by a remote attacker on the Logstash instance when using the Netflow Codec plugin. This is achieved by crafting malicious Netflow v5, Netflow v9, or IPFIX packets. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit.

Recommendations For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Netflow Codec plugin to minimize the risk of exploitation.

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-248

CWE-404

Related Identifiers

CVE-2016-10363

Affected Products

Logstash

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-10363 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10363 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory