Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2025-37730 Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client”…

Description

Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.

Produits et versions touchés

Produit Versions touchées Corrigé en
Logstash 9.0 9.0.0 → < 9.0.1 9.0.1
Logstash 8.18 8.18.0 → < 8.18.1 8.18.1
Logstash 8.0 8.0.0 → < 8.17.6 8.17.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Logstash

Les 9 CVE de Logstash →
CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and… 8.1 Élevée CVE-2023-46672 An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific… 8.4 Élevée CVE-2019-7620 Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin Non notée CVE-2019-7612 A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs Non notée
Suivre cette CVE