HIGH7.5
GHSA-vcmm-ppqx-95ch
Logstash Logs Sensitive Information
Quick fix
GHSA-vcmm-ppqx-95ch — logstash-core: upgrade to the fixed version with the command below.
bundle update logstash-coreDetails
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000221[ADVISORY]
- https://github.com/elastic/logstash/commit/0999050144adad7f4d99d43e561c2882fd7c512b[WEB]
- https://github.com/elastic/logstash[PACKAGE]
- https://web.archive.org/web/20210124065200/http://www.securityfocus.com/bid/99126[WEB]
- https://www.elastic.co/community/security[WEB]