Description
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
References (3)
Core 3
Core References
Various Sources x_refsource_confirm
http://www.elasticsearch.org/blog/logstash-1-4-2/
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/532841/100/0/threaded
Vendor Advisory x_refsource_confirm
https://www.elastic.co/community/security/
Scores
EPSS
0.0088
EPSS Percentile
75.6%
Details
CWE
CWE-78
Status
published
Products (28)
elastic/logstash
1.0.14
elastic/logstash
1.0.15
elastic/logstash
1.0.16
elastic/logstash
1.0.17
elastic/logstash
1.1.0
elastic/logstash
1.1.0.1
elastic/logstash
1.1.1
elastic/logstash
1.1.2
elastic/logstash
1.1.3
elastic/logstash
1.1.4
... and 18 more
Published
Jul 22, 2014
Tracked Since
Feb 18, 2026