CVE-2015-5619

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-08-09 · updated 2026-06-17
Weakness: CWE-295

Description

Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.

Affected products

Elastic Logstash: 1.4.0, 1.4.1, 1.4.2
Elasticsearch Logstash: 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.2, 1.5.3

References

http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html
http://www.securityfocus.com/archive/1/536294/100/0/threaded
http://www.securityfocus.com/archive/1/536858/100/0/threaded
http://www.securityfocus.com/bid/76455
https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released
http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html
http://www.securityfocus.com/archive/1/536294/100/0/threaded
http://www.securityfocus.com/archive/1/536858/100/0/threaded
http://www.securityfocus.com/bid/76455
https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released

Get alerted when CVE-2015-5619 or the next vulnerability affects your stack