Elastic: >> Logstash >> 1.0.0 Security Vulnerabilities
A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.
CVSS Score
9.8
EPSS Score
0.005
Published
2019-03-25
When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information.
CVSS Score
6.5
EPSS Score
0.003
Published
2018-03-30
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
CVSS Score
7.5
EPSS Score
0.007
Published
2017-06-16
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.
CVSS Score
7.5
EPSS Score
0.004
Published
2017-06-16
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of service attack on the Logstash instance. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit.
CVSS Score
7.5
EPSS Score
0.006
Published
2017-06-16
Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.
CVSS Score
6.4
EPSS Score
0.006
Published
2015-06-15