Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-22138

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elasticsearch

  • after 6.4.0 and before 6.8.15 and 7.12.0affected

References