CVE-2014-4326 Elasticsearch Logstash allows remote attackers to execute arbitrary commands
HighCVSS 7.5
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems logstash(RubyGems) | >= 1.0.14, < 1.4.2 | 1.4.2 |
| Elastic logstash | = 1.0.14 | No fix listed |
| Elastic logstash | = 1.0.15 | No fix listed |
| Elastic logstash | = 1.0.16 | No fix listed |
| Elastic logstash | = 1.0.17 | No fix listed |
| Elastic logstash | = 1.1.0 | No fix listed |
| Elastic logstash | = 1.1.0.1 | No fix listed |
| Elastic logstash | = 1.1.1 | No fix listed |
| Elastic logstash | = 1.1.2 | No fix listed |
| Elastic logstash | = 1.1.3 | No fix listed |
| Elastic logstash | = 1.1.4 | No fix listed |
| Elastic logstash | = 1.1.5 | No fix listed |
| Elastic logstash | = 1.1.6 | No fix listed |
| Elastic logstash | = 1.1.7 | No fix listed |
| Elastic logstash | = 1.1.8 | No fix listed |
| Elastic logstash | = 1.1.9 | No fix listed |
| Elastic logstash | = 1.1.10 | No fix listed |
| Elastic logstash | = 1.1.11 | No fix listed |
| Elastic logstash | = 1.1.12 | No fix listed |
| Elastic logstash | = 1.1.13 | No fix listed |
| Elastic logstash | = 1.2.1 | No fix listed |
| Elastic logstash | = 1.2.2 | No fix listed |
| Elastic logstash | = 1.3.0 | No fix listed |
| Elastic logstash | = 1.3.1 | No fix listed |
| Elastic logstash | = 1.3.2 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Elastic logstash | = 1.3.3 | No fix listed |
| Elastic logstash | = 1.4.0 | No fix listed |
| Elastic logstash | = 1.4.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- web.archive.org
- web.archive.org
- www.elastic.co vendor-advisory
- www.elasticsearch.org
- 20140718 CVE-2014-4326 Remote command execution in Logstash zabbix and nagios_nsca outputs. mailing-list
- github.com