CVE-2015-5619: Elastic Logstash

Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days.

Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.

Affected products

• Elastic Logstash: version 1.4.0 only; version 1.4.1 only; version 1.4.2 only
• Elasticsearch Logstash: version 1.4.3 only; version 1.4.4 only; version 1.5.0 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only

Published 2017-08-09. Last modified 2026-06-17.