442 matches found
Security Bulletin: Log4j remote code execution vulnerability in Apache Solr and Logstash shipped with IBM Operations Analytics - Log Analysis (CVE-2021-44228)
Summary IBM Operations Analytics - Log Analysis is bundled with Apache-Solr and Logstash Third-party components which are affected by the "CVE-2021-44228" security vulnerability. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitra...
Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Archive Enterprise Edition (CVE-2021-44228)
Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Archive Enterprise Edition EE. The below fix package includes Apache Log4j 2.15. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache...
SUSE-SU-2021:4190-1 Security update for logstash
This update for logstash fixes the following issues: Fixed vulnerability related to log4j version 1.2.x - CVE-2021-4104: Fixed remote code execution through the JMS API via the ldap JNDI parser bsc1193662...
SUSE-SU-2021:4160-1 Security update for logstash, elasticsearch, kafka, zookeeper, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-thresh
This update for logstash, elasticsearch, kafka, zookeeper, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-thresh fixes the following issues: Fixed vulnerability related to log4j version 1.2.x: - CVE-2021-4104: Fixed remote code execution through the JMS API via the...
Elastic Logstash Multiple Log4j Vulnerabilities (Dec 2021)
Elastic Logstash is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation
Note — These instructions only apply if you are running Logstash 5.0.0 - 6.8.20, or 7.0.0 - 7.16.0. If you are running an older version of Logstash, or a version of Logstash = 6.8.21 in the 6.x series or = 7.16.1 in the 7.x series, these instructions do not apply. Please follow the guidance in ma...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Log4JExploitation-VulnerabiliyCVE-2021-44228. !Untitled...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Log4JExploitation-VulnerabiliyCVE-2021-44228. !Untitled...
Elastic Logstash Multiple Log4j Vulnerabilities (ESA-2021-31, Log4Shell)
Elastic Logstash is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
VPN Exposes Data for 1M Users, Leading to Researcher Questioning
Free virtual private network VPN service Quickfox, which provides access to Chinese websites from outside the country, exposed the personally identifiable information PII of more than a million users in just the latest high-profile VPN security failure. The incident has some security practitioner...
Elastic Logstash Certificate Verification Bypass Vulnerability (ESA-2021-09)
Elastic Logstash is prone to a certificate verification bypass vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2021-22138
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in...
CVE-2021-22138
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in...
Security feature bypass
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in...
CVE-2021-22138
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in...
CVE-2021-22138
CVE-2021-22138 : Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 contain a TLS certificate validation flaw in the monitoring feature. When a trusted server CA certificate is specified, Logstash may fail to properly verify the monitoring server’s certificate, enabling a possible man-in-...
PT-2021-14866 · Elastic +1 · Logstash +1
Name of the Vulnerable Software and Affected Versions: Logstash versions after 6.4.0 and before 6.8.15 Logstash versions prior to 7.12.0 Description: A TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate, Logstash would not properly...
Elasticsearch Logstash 信任管理问题漏洞
Elasticsearch Logstash is a suite of log analysis and monitoring tools from the Dutch company Elasticsearch. A security vulnerability exists in Logstash. The vulnerability stems from a TLS certificate validation vulnerability in the program's monitoring feature, which could allow a...
Man-in-the-middle (MITM)
xpack is vulnerable to man-in-the-middle attack. The vulnerability exists because verification of SSL/TLS certificates are not properly done, allowing a man in the middle attack against the Logstash monitoring data...
