Description
Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Logstash | 8.0.0 – < 8.17.6, 8.18.0 – < 8.18.1, 9.0.0 – < 9.0.1 | 8.17.6 |
Advisories 1
- WID-SEC-2025-0952 LogStash: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · May 6, 2025