Improper certificate validation in Logstash's TCP output...
Published: May 06, 2025
SECURITY IDENTIFIERS
- CVE: CVE-2025-37730 (NVD)
- GHSA: GHSA-qrf7-ph5v-mj2v
GEM
SEVERITY
CVSS v3.x: 6.5 (Medium)
PATCHED VERSIONS
~> 6.2.2
>= 7.0.1
DESCRIPTION
Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2025-37730
- https://rubygems.org/gems/logstash-output-tcp/versions/7.0.1
- https://rubygems.org/gems/logstash-output-tcp/versions/6.2.2
- https://github.com/logstash-plugins/logstash-output-tcp/blob/main/CHANGELOG.md#701
- https://github.com/logstash-plugins/logstash-output-tcp/pull/61
- https://github.com/logstash-plugins/logstash-output-tcp/commit/e32bd16a1d96cd0bc821fa4b93149934050f4040
- https://discuss.elastic.co/t/logstash-8-17-6-8-18-1-and-9-0-1-security-update-esa-2025-08/377869
- https://github.com/advisories/GHSA-qrf7-ph5v-mj2v