GitHub Advisoryadvisory · RubyGems

GHSA-3gg4-6hqg-2vjx Logstash Logs Sensitive Information

MEDIUM Published 2022-05-13 Modified 2023-11-22 Official page ↗

Aliases: CVE-2016-10362
Ecosystem: RubyGems
Packages: logstash-core
Severity: Moderate
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-200
Reviewed: 2023-07-28

Affected packages

• RubyGems logstash-core: < 5.0.1 → fixed in 5.0.1

Description

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.

Related

Alias · CVE (1)

CVE-2016-10362 Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth… vulnerability

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References