CVE-2019-7620 — Uncontrolled Resource Consumption in Logstash

CWE-400 — Uncontrolled Resource Consumption3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.4%
top 19.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Logstash
Timeline
PublishedOct 30
Latest updateMay 24

Description

Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDelastic/logstash6.0.0 — 6.8.4+1
▶CVEListV5elastic/logstashbefore 7.4.1 and 6.8.4

🔴Vulnerability Details

2
GHSA
GHSA-77mg-86wc-vj3g: Logstash versions before 7↗2022-05-24
▶
CVEList
CVE-2019-7620: Logstash versions before 7↗2019-10-30
▶
CVE-2019-7620 — Uncontrolled Resource Consumption | cvebase