CVE-2021-22138
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a...
Original description
The description as published by the source.
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.
Affected packages
Bitnami
logstash
[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.8.15"},{"introduced":"7.0.0"},{"fixed":"7.12.0"}]}]
References
- advisory discuss.elastic.co
- advisory security.netapp.com
- web nvd.nist.gov