On what version of logstash has fix for issue AIKIDO-2024-10428

Elastic Stack Logstash
1

Hello there,

Our internal container image scanning tool has flagged a vulnerability related to JRuby’s StringIO library bundled with Logstash 8.19.7.

Issue Details

A vulnerability was reported in StringIO, where the methods

  • StringIO#ungetc and

  • StringIO#ungetbyte
    may use uninitialized memory, leading to potential memory corruption or unexpected behavior.

Our scan indicates that Logstash 8.19.7 includes stringio 3.0.8, while the patched version is 3.1.2 or later.

Request

Could you please clarify:

  1. Which Logstash version includes JRuby with StringIO ≥ 3.1.2?

  2. Is there any official documentation listing components or Ruby/JRuby gem versions bundled with each Logstash release?

  3. If a fix is pending, is there an expected timeline or workaround (e.g., manual override, plugin update, custom JRuby upgrade)?

I have not found publicly available information detailing the specific JRuby/StringIO versions packaged with each Logstash build, so guidance would be highly appreciated.

Thanks in advance for your support!

Thanks & Regards,

Saikiran

2

As mentioned on the Community Slack, you need to send this to security@elastic.co for them to validate if this is impact Logstash or not.