# Elastic Stack 6.1.2 and 5.6.6 security update

**URL:** <https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763>\
**Category:** Security Announcements\
**Created:** [January 16, 2018, 5:08pm UTC](https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 "2018-01-16T17:08:35Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\
**Post date:** [January 16, 2018, 5:08pm UTC](https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763/1 "2018-01-16T17:08:35Z")

</div>

**Logstash sensitive information disclosure issue (ESA-2018-01)**  
When logging warnings regarding deprecated settings, Logstash could inadvertently log sensitive information.

**Affected Versions**  
All versions before 6.1.2 and 5.6.6

**Solutions and Mitigations:**  
Users should upgrade to Logstash version 6.1.2 or 5.6.6. If you are unable to upgrade you should review your settings to ensure no deprecated settings are used in your environment.

**CVE ID:** CVE-2018-3817

* * *

**Kibana XSS issue (ESA-2018-02)**  
Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

**Affected Versions**  
Versions 5.1.1 to 6.1.2 and 5.6.6

**Solutions and Mitigations:**  
Users should upgrade to Kibana version 6.1.2 or 5.6.6. There are no known workarounds for this issue.

**CVE ID:** CVE-2018-3818

---

_[View the full topic](https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763)._