Logstash: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2015.0075
              A vulnerability has been identified in Logstash
                               24 July 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Logstash
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Access Privileged Data         -- Remote/Unauthenticated
                      Provide Misleading Information -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2015-5378  
Member content until: Sunday, August 23 2015

OVERVIEW

        A vulnerability has been identified in Logstash prior to versions 1.5.3
        and 1.4.4. [1]


IMPACT

        The vendor has provided the following details regarding these 
        vulnerabilities:
        
        CVE-2015-5378: "Logstash 1.5.2 and prior versions are vulnerable to
        a SSL/TLS security issue called the FREAK attack. If you are using 
        the Lumberjack input, FREAK allows an attacker to successfully 
        implement a man in the middle attack, intercepting communication 
        between the Logstash Forwarder agent and Logstash server.
        
        Note: Only deployments using the Logstash Forwarder or the 
        Lumberjack input are affected by this vulnerability." [1]


MITIGATION

        The vendor recommends updating to the latest versions of Logstash to
        correct this issue. [1]


REFERENCES

        [1] Logstash SSL/TLS FREAK Vulnerability CVE-2015-5378
            https://discuss.elastic.co/t/logstash-ssl-tls-freak-vulnerability-cve-2015-5378/26023

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVbGEcH6ZAP0PgtI9AQLicg/+IVU/DKFA19BllV0YRNi9Ku6Wl40obhnL
Scs33XMofgDN0bM6TECTeweq6AI0M1GHEARWzmut4cgfwul8rrToE59WWGNGu9jF
lAK6esJtF9KJZZsVNMiZp5BPOCwbU0d6it1PwMUrtNNkUou+PIKH/EFfU6EIzkLQ
V+WVckznMoAII2tfcJKFnjbF0d5qDwx4lBNVRrantq49TizaN9sIkVlrbeHsFqGN
nRaBWbcJxShpXyufUZa9/h9IpY66q8vYk+1SFxOXMIKBcy6SJRkOt8s7jL4+0X0e
Q2zPFPIo82IDIscSSk5seo3VCVyJe0du2wW+KYxFbWMOcfPoxW+tOLaiG/OFMGWf
Qf3+W+2nEZx6/YIS/OmYA2/7mdovrkeizcORNYd3DmgnqNrIDLnLU82hynRmA2IM
xBsTcufk3ynyEnc7HlhlrJRvh15ExZxL6rKlR0DkbxoHXh5cPvyXjQd2DIZiLsbt
bmEWNWr5+8HacJpg64uUUrahKO2dPg44sn+ZP/7Nd2VJCIgOqi89JJcykHAeduR3
k1SjVXiNdvDKSsZTsPgPL5a7kzJ/GHN80fE/30Y9gZmGlmT8OMRsNETImv7R0t4B
BOxA6YYIhHEFqDy/ZMlC4PXdJKp5RtSWyVgeikRBMFaiGppuzF4h6bU1Ur1hQ2UT
uejAHyzWNDA=
=M2o8
-----END PGP SIGNATURE-----