Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

中 5.3CVE-2025-30373 · GHSA-q7g5-jq6p-6wvx · 07/04/2025 公開 · 17/06/2026 更新

要点

CVE-2025-30373 は org.graylog2:graylog2-server, graylog (graylog) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.34%（全脆弱性の 27.0% より高い）。
対処：6.1.9 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.graylog2:graylog2-server Maven	`≥ 6.1.0, < 6.1.9`	`6.1.9`
graylog graylog	`≥ 6.1.0, < 6.1.9`	`6.1.9`

概要

Impact

Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.

Patches

Workarounds

Disabling http-based inputs and allow only authenticated pull-based inputs.

Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd

NVD の説明

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.