CVE-2019-7612

Опубликовано: 25 мар. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 5

EPSS Низкий

Описание

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.

Ссылки

https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190411-0002/
Third Party Advisory
https://www.elastic.co/community/security
Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190411-0002/
Third Party Advisory
https://www.elastic.co/community/security
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*

Версия до 5.6.15 (исключая)

cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.6.1 (исключая)

Конфигурация 2

cpe:2.3:a:netapp:active_iq_performance_analytics_services:-:*:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00467

Низкий

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-209

CWE-532

Связанные уязвимости

CVE-2019-7612

CVSS3: 9.8

debian

почти 7 лет назад

A sensitive data disclosure flaw was found in the way Logstash version ...

GHSA-76jg-hr4p-qmfv

CVSS3: 9.8

github

больше 3 лет назад

EPSS

Процентиль: 64%

0.00467

Низкий

9.8 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-209

CWE-532