We are announcing the release of logstash 1.5.4 and 1.4.5 which fixes important security issues. Our recommendation is to upgrade immediately if you are using either of the following features:
Logstash forwarder: After the release of 1.5.3, users encountered an issue where Logstash Forwarder was unable to communicate to Logstash instance because of SSL/TLS certificate validation errors. This has been fixed.
Lumberjack output: Typically used to connect two Logstash instances. In such deployments, one Logstash instance is used to collect logs from a webserver and securely transmit them to a central Logstash instance to perform additional filtering and storing.
Security Fixes
When using SSL/TLS functionality, Lumberjack output from Logstash 1.5.3 and prior versions did not validate certificate presented by the Logstash instance acting as a server. This exposes a man in the middle vulnerability.
We have been assigned CVE-2015-5619 for this issue and have added this vulnerability to our CVE page.
Note: Users of Logstash Forwarder are not affected by this particular vulnerability
Enhancements
Elasticsearch Output: Added the ability to update existing ES documents and support of upsert -- if document doesn't exist, create it (#116). Thanks to David Chauviere for contributing this enhancement!
Example configuration:
output { if [use_case] == "doc_upsert" { elasticsearch { host => "elasticsearch" protocol => "http" action => "update" document_id => "%{[uid]}" doc_as_upsert => true } } else if [use_case] == "doc_static_upsert" { elasticsearch { host => "elasticsearch" protocol => "http" action => "update" document_id => "%{[uid]}" upsert => '{"static_field": "demo"}' } } else if [use_case] == "doc_dynamic_upsert" { elasticsearch { host => "elasticsearch" protocol => "http" action => "update" document_id => "%{[uid]}" upsert => '{"use_case": "%{[use_case]}", "dynamic": { "fieldC": "%{[dynamic_field][fieldC]}"}}' } } }
Bug fixes
Below is a list of bug fixes in core and plugins. For a full list, please check the changelog.
- Reverted a change in our harden SSL fix, that prevented Logstash Forwarder and Lumberjack output clients to connect to 1.5.3 instances (#3657)
- Updated Concurrent-ruby library usage to suppress deprecation warnings (#3662)
- Lumberjack input: Fixed a scenario where Logstash Forwarder could lose events when dealing with congestion from downstream plugins. We were incorrectly calculating the window size of payload in the acknowledgement stage. (#3691)
- File input: Fix double ingestion issue when using glob path (#3674)
- AWS mixin: Correctly configure the proxy when using V2 version of the mixin. (#15)
- Lumberjack ouput: Added better handling of congestion scenario by using a buffered payloads (#7)
Feedback
Please download Logstash 1.5.4 and let us know what you think on Twitter (@elastic) or on our forum. You can report any problems on the GitHub issues page.