CVE-2021-22138
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.
Paquets affectés
Bitnami
logstash
[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.8.15"},{"introduced":"7.0.0"},{"fixed":"7.12.0"}]}]
Références
- advisory discuss.elastic.co
- advisory security.netapp.com
- web nvd.nist.gov