# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=12 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 13 --- ## [Elastic Stack 5.4.3 Security update](https://discuss.elastic.co/t/elastic-stack-5-4-3-security-update/91006)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [June 27, 2017, 5:16pm UTC](https://discuss.elastic.co/t/elastic-stack-5-4-3-security-update/91006 "2017-06-27T17:16:27Z")
Kibana X-Pack Security user credentials disclosure (ESA-2017-11) In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized… --- ## [Elastic Stack 5.4.1 and 5.3.3 Security updates](https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [June 1, 2017, 4:29pm UTC](https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 "2017-06-01T16:29:34Z")
X-Pack 5.4.1 privilege escalation (ESA-2017-06) X-Pack 5.4.1 has been released which fixes a privilege escalation bug in the run\_as functionality. This bug prevents transitioning into the specified user specified in a … --- ## [Protect your data from ransom attacks](https://discuss.elastic.co/t/protect-your-data-from-ransom-attacks/72027)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [January 18, 2017, 2:40pm UTC](https://discuss.elastic.co/t/protect-your-data-from-ransom-attacks/72027 "2017-01-18T14:40:08Z")
I wanted to bring attention to two blog posts we have done recently in response to the recent set of data ransom attacks affecting Elasticsearch and other systems. The two are: For Elasticsearch: Protecting Against A… --- ## [Kibana 5.0.2 released with a fix for improper authentication](https://discuss.elastic.co/t/kibana-5-0-2-released-with-a-fix-for-improper-authentication/67527)
**Author:** [@Court](https://discuss.elastic.co/u/Court)\ **Replies:** 0\ **Last updated:** [November 29, 2016, 5:14pm UTC](https://discuss.elastic.co/t/kibana-5-0-2-released-with-a-fix-for-improper-authentication/67527 "2016-11-29T17:14:19Z")
With X-Pack installed, operations in the Advanced Settings panel of the Management tab and operations from the short URL service were performed as the "Kibana Server" user regardless of the user that is currently authent… --- ## [Kibana 5.0.1 and 4.6.3 released with a fix for an open redirect vulnerability](https://discuss.elastic.co/t/kibana-5-0-1-and-4-6-3-released-with-a-fix-for-an-open-redirect-vulnerability/66142)
**Author:** [@Court](https://discuss.elastic.co/u/Court)\ **Replies:** 0\ **Last updated:** [November 15, 2016, 6:13pm UTC](https://discuss.elastic.co/t/kibana-5-0-1-and-4-6-3-released-with-a-fix-for-an-open-redirect-vulnerability/66142 "2016-11-15T18:13:19Z")
Kibana versions 5.0.1 and 4.6.3 fix an open redirect vulnerability in the short URL feature that would allow an attacker to create a redirect from the Kibana domain to a different website. We’ve assigned this vulnerabili… --- ## [Logstash 5.0.1 released with a security patch](https://discuss.elastic.co/t/logstash-5-0-1-released-with-a-security-patch/66156)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [November 15, 2016, 7:02pm UTC](https://discuss.elastic.co/t/logstash-5-0-1-released-with-a-security-patch/66156 "2016-11-15T19:02:53Z")
Hi all, we would like to announce that Logstash 5.0.1 has been released with an important security patch. Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log t… --- ## [Kibana 4.6.2 released with a security fix for an XSS vulnerability](https://discuss.elastic.co/t/kibana-4-6-2-released-with-a-security-fix-for-an-xss-vulnerability/63807)
**Author:** [@Court](https://discuss.elastic.co/u/Court)\ **Replies:** 0\ **Last updated:** [October 24, 2016, 10:00pm UTC](https://discuss.elastic.co/t/kibana-4-6-2-released-with-a-security-fix-for-an-xss-vulnerability/63807 "2016-10-24T22:00:46Z")
Today, we've published Kibana 4.6.2 as a security release with a fix for an XSS vulnerability with field formatters. Any users of Kibana versions 4.3 to 4.6 are encouraged to update to 4.6.2 immediately. Kibana version 4… --- ## [Logstash 2.3.2 Vulnerability with Netflow codec plugin](https://discuss.elastic.co/t/logstash-2-3-2-vulnerability-with-netflow-codec-plugin/61301)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [September 22, 2016, 6:31pm UTC](https://discuss.elastic.co/t/logstash-2-3-2-vulnerability-with-netflow-codec-plugin/61301 "2016-09-22T18:31:33Z")
Hi all, we've published ESA-2016-06 for a vulnerability in netflow codec plugin for Logstash 2.3.2. Thanks to Jorrit Folmer (maintainer of netflow codec) for reporting and fixing this issue. Details below: Vulnerabilit… --- ## [Logstash 2.3.3 Elasticsearch Output Vulnerability](https://discuss.elastic.co/t/logstash-2-3-3-elasticsearch-output-vulnerability/54973)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [July 7, 2016, 4:57pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-elasticsearch-output-vulnerability/54973 "2016-07-07T16:57:05Z")
Hi all, we would like to announce a security vulnerability we discovered in our testing. Logstash 2.3.4 has been released with a patch to fix this. Issue Prior to version 2.3.4, Elasticsearch Output plugin would log to… --- ## [Kibana 4.4.2, 4.3.3, 4.1.6 - Updated node.js versions due to upstream vulnerabilities](https://discuss.elastic.co/t/kibana-4-4-2-4-3-3-4-1-6-updated-node-js-versions-due-to-upstream-vulnerabilities/44075)
**Author:** [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\ **Replies:** 0\ **Last updated:** [March 10, 2016, 7:52pm UTC](https://discuss.elastic.co/t/kibana-4-4-2-4-3-3-4-1-6-updated-node-js-versions-due-to-upstream-vulnerabilities/44075 "2016-03-10T19:52:28Z")
Same deal as last month, but we've bumped all 3 version to node v4.3.2 to cover security issues in node.js. You can read their maintenance announcement here: https://nodejs.org/en/blog/release/v4.3.2/ Check out the b… --- ## [Logstash 2.2.1 Elasticsearch Output Vulnerability](https://discuss.elastic.co/t/logstash-2-2-1-elasticsearch-output-vulnerability/42091)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [February 18, 2016, 2:03am UTC](https://discuss.elastic.co/t/logstash-2-2-1-elasticsearch-output-vulnerability/42091 "2016-02-18T02:03:37Z")
Logstash version 2.2.1 is vulnerable to a man in the middle attack when used with Elasticsearch output. In version 2.2.1, the config which enables SSL/TLS default has been disabled inadvertently, so a malicious user coul… --- ## [Kibana 4.4.1, 4.3.2, 4.1.5 - Updated node.js versions due to upstream vulnerabilities](https://discuss.elastic.co/t/kibana-4-4-1-4-3-2-4-1-5-updated-node-js-versions-due-to-upstream-vulnerabilities/41643)
**Author:** [@Court](https://discuss.elastic.co/u/Court)\ **Replies:** 0\ **Last updated:** [February 12, 2016, 5:01pm UTC](https://discuss.elastic.co/t/kibana-4-4-1-4-3-2-4-1-5-updated-node-js-versions-due-to-upstream-vulnerabilities/41643 "2016-02-12T17:01:35Z")
Summary: The bundled versions of node.js in Kibana contain HTTP-related security vulnerabilities. Fixed versions of node.js were recently released. For the original node.js security announcement, see https://nodejs.… --- ## [Logstash CSV Output Vulnerability - CVE pending](https://discuss.elastic.co/t/logstash-csv-output-vulnerability-cve-pending/40777)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [February 2, 2016, 6:32pm UTC](https://discuss.elastic.co/t/logstash-csv-output-vulnerability-cve-pending/40777 "2016-02-02T18:32:09Z")
Summary: Logstash 2.2 and prior versions are vulnerable to a formula based injection, when using the CSV output plugin. This plugin allows users to export data in comma separated values and is susceptible to an attack i… --- ## [Kibana 4.x XSS -- CVE pending](https://discuss.elastic.co/t/kibana-4-x-xss-cve-pending/37523)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [December 18, 2015, 12:53am UTC](https://discuss.elastic.co/t/kibana-4-x-xss-cve-pending/37523 "2015-12-18T00:53:40Z")
Summary Kibana versions up to and including 4.3.0, 4.2.1, and 4.1.3 are vulnerable to a cross-site scripting (XSS) attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser. We h… --- ## [Kibana Cross-site Request Forgery CVE-2015-8131](https://discuss.elastic.co/t/kibana-cross-site-request-forgery-cve-2015-8131/35002)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [November 18, 2015, 10:46pm UTC](https://discuss.elastic.co/t/kibana-cross-site-request-forgery-cve-2015-8131/35002 "2015-11-18T22:46:50Z")
CVE: CVE-2015-8131 Affected versions: All versions up to and including 4.1.2 and 4.2.0. The vulnerability is a cross-site request forgery (CSRF or XSRF) that could allow an attacker to read and write changes to the .… --- ## [Kibana 3.1.3](https://discuss.elastic.co/t/kibana-3-1-3/26664)
**Author:** [@rashid](https://discuss.elastic.co/u/rashid)\ **Replies:** 0\ **Last updated:** [July 31, 2015, 8:35pm UTC](https://discuss.elastic.co/t/kibana-3-1-3/26664 "2015-07-31T20:35:27Z")
We've identified two content sanitation issues in Kibana 3. While these are low impact and difficult to trigger we're releasing Kibana 3.1.3 to correct them: https://www.elastic.co/downloads/past-releases/kibana-3-1-3 --- ## [Logstash SSL/TLS FREAK Vulnerability CVE-2015-5378](https://discuss.elastic.co/t/logstash-ssl-tls-freak-vulnerability-cve-2015-5378/26023)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [July 21, 2015, 8:44pm UTC](https://discuss.elastic.co/t/logstash-ssl-tls-freak-vulnerability-cve-2015-5378/26023 "2015-07-21T20:44:44Z")
Logstash 1.5.2 and prior versions are vulnerable to a SSL/TLS security issue called the FREAK attack. If you are using the Lumberjack input, FREAK allows an attacker to successfully implement a man in the middle attack, … --- ## [Elasticsearch directory traversal vulnerability CVE-2015-5531](https://discuss.elastic.co/t/elasticsearch-directory-traversal-vulnerability-cve-2015-5531/25737)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [July 16, 2015, 5:31pm UTC](https://discuss.elastic.co/t/elasticsearch-directory-traversal-vulnerability-cve-2015-5531/25737 "2015-07-16T17:31:51Z")
Summary Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to retrieve files that are readable by the Elasticsearch JVM process. We have been assigned CV… --- ## [Elasticsearch remote code execution CVE-2015-5377](https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [July 16, 2015, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736 "2015-07-16T17:30:03Z")
Summary Elasticsearch versions prior to 1.6.1 are vulnerable to an engineered attack on its transport protocol that enables remote code execution. This issue is related to the Groovy announcement in CVE-2015-3253. D… --- ## [Kibana Cross-Site Scripting Vulnerability CVE-2015-4093](https://discuss.elastic.co/t/kibana-cross-site-scripting-vulnerability-cve-2015-4093/2258)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [June 9, 2015, 9:43pm UTC](https://discuss.elastic.co/t/kibana-cross-site-scripting-vulnerability-cve-2015-4093/2258 "2015-06-09T21:43:31Z")
Summary: Kibana versions 4.0.0, 4.0.1 and 4.0.2 are vulnerable to a cross-site scripting (XSS) attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser. We have been assigned CVE… --- ## [Logstash File Output Vulnerability CVE-2015-4152](https://discuss.elastic.co/t/logstash-file-output-vulnerability-cve-2015-4152/2257)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [June 9, 2015, 9:42pm UTC](https://discuss.elastic.co/t/logstash-file-output-vulnerability-cve-2015-4152/2257 "2015-06-09T21:42:06Z")
Summary: Logstash versions 1.4.2 and prior are vulnerable to a directory traversal attack that allows an attacker to over-write files on the server running Logstash. This vulnerability is not present in the initial insta… --- ## [Elasticsearch Engineered Attack Vulnerability CVE-2015-4165](https://discuss.elastic.co/t/elasticsearch-engineered-attack-vulnerability-cve-2015-4165/2256)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [June 9, 2015, 9:40pm UTC](https://discuss.elastic.co/t/elasticsearch-engineered-attack-vulnerability-cve-2015-4165/2256 "2015-06-09T21:40:28Z")
Summary: Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are … [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=11)