CVE-2019-7620

Опубликовано: 30 окт. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding.

Ссылки

https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908
Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-7-4-1-security-update/204909
Vendor Advisory
https://www.elastic.co/community/security
Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908
Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-7-4-1-security-update/204909
Vendor Advisory
https://www.elastic.co/community/security
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.8.4 (исключая)

cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.4.1 (исключая)

EPSS

Процентиль: 80%

0.01406

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-400

NVD-CWE-noinfo

Связанные уязвимости

GHSA-77mg-86wc-vj3g