CVE-2019-7620
High
Description
Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding.
SeverityHigh
CVSS7.5
Exploit probability—
ProductElastic Logstash
PublishedOct 30, 2019
First seenOct 30, 2019
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- elastic logstash6.8.4, 7.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic logstash | 6.0.0 ≤ v < 6.8.4, 7.0.0 ≤ v < 7.4.1 | 6.8.4, 7.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.