Vulnerability · Published May 13, 2021 · Assigned by elastic
CVE-2021-22138
Low 3.7
In plain English
A low-severity improper certificate validation in Elasticsearch from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS NVD)3.7Low
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch | after 6.4.0 and before 6.8.15 and 7.12.0 |
Weakness: CWE-295
References
- https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210629-0001/ x_refsource_CONFIRM