Logstash Logs Sensitive Information

ALTO 7.5CVE-2016-1000221 · GHSA-vcmm-ppqx-95ch · Published 16/06/2017 · updated 17/06/2026

En resumen

CVE-2016-1000221 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a logstash-core, logstash (elastic).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.8%, mayor que el 78.3% de las vulnerabilidades.
Solución: actualizar a 2.3.4 o posterior.

Package	Affected versions	Patched versions
logstash-core RubyGems	`< 2.3.4`	`2.3.4`
logstash elastic	`≤ 2.3.3`	No fix yet

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.

NVD description

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.