CVE-2015-5378 Elasticsearch Logstash Man in the Middle Security Bypass Vulnerability (ESA-2015-07) (FREAK Attack)

ElasticSearch Logstash is an open source, server-side data processing pipeline that ingests data from a multitude of sources simultaneously, transforms it, and then sends it to your favorite 'stash'.

All Logstash versions prior to 1.5.2 that use Lumberjack input (in combination with Logstash Forwarder agent) are vulnerable to a SSL/TLS security issue called the FREAK attack. This allows an attacker to intercept communication and access secure data.

Affected Versions:
ElasticSearch Logstash versions prior to 1.5.2 QID Detection Logic (Authenticated):
This QID checks for the installed Logstash package.

A remote attacker could exploit this vulnerability to perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks.

Customers are advised to upgrade to the latest version of Logstash. Refer to Logstash Downloads for more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ESA-2015-07 (Elasticsearch Logstash )