Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

elastic/logstash

              main @ 316a027
            

Fixes

CVEs

CRITICAL

Peak severity

47.6%

Coverage

Highlights

Information Disclosure: 5 prior fixes. Scrutinize any change in this area.

logstash-core/src/main/java/org/logstash/common/BufferedTokenizerExt.java: most-fixed (2 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: Multiple fixes address plaintext password exposure in logs and stored parameters, indicating a systemic issue with secret handling.

Improper Certificate Validation: TLS verification bypasses recur in monitoring and management, often due to incorrect boolean handling or missing verification options.

Path Traversal: Archive extraction and offline pack preparation both lacked path validation, risking arbitrary file writes or deletions.