CVE-2016-10362 Elasticsearch Logstash Information Disclosure Vulnerability (ESA-2016-08)

ElasticSearch Logstash is an open source, server-side data processing pipeline that ingests data from a multitude of sources simultaneously, transforms it, and then sends it to your favorite 'stash'.

Elasticsearch Logstash is prone to an information-disclosure vulnerability.

Affected Versions:
ElasticSearch Logstash versions prior to 5.0.1 QID Detection Logic (Authenticated):
This QID checks for the installed Logstash package

A remote attacker could exploit this vulnerability to obtain potentially sensitive information. This may lead to further attacks.

Customers are advised to upgrade to the latest version of Logstash. Refer to Logstash Downloads for more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ESA-2016-08 (Elasticsearch Logstash )