# Logstash 2.3.3 Elasticsearch Output Vulnerability
**URL:** https://discuss.elastic.co/t/logstash-2-3-3-elasticsearch-output-vulnerability/54973
**Category:** Security Announcements
**Created:** [July 7, 2016, 4:57pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-elasticsearch-output-vulnerability/54973 "2016-07-07T16:57:05Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@suyograo](https://discuss.elastic.co/u/suyograo)
#### Post date: [July 7, 2016, 4:57pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-elasticsearch-output-vulnerability/54973/1 "2016-07-07T16:57:05Z")
Hi all, we would like to announce a security vulnerability we discovered in our testing. Logstash 2.3.4 has been [released](https://www.elastic.co/downloads/logstash) with a patch to fix this.
**Issue**
Prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
**Remediation**
Users who secure communication from Logstash to Elasticsearch via Basic Authorization using Elastic Shield or other systems are advised to upgrade to Logstash 2.3.4 version.
We have assigned Elastic Security Advisory (ESA) number ESA-2016-02 for this and our [security page](https://www.elastic.co/community/security) is updated with details.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-elasticsearch-output-vulnerability/54973/2 "2017-07-06T13:46:23Z")