From owner-freebsd-ports-bugs@FreeBSD.ORG  Wed Jun 10 11:33:32 2015
Return-Path: <owner-freebsd-ports-bugs@FreeBSD.ORG>
Delivered-To: freebsd-ports-bugs@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 997D1B3C
 for <freebsd-ports-bugs@FreeBSD.org>; Wed, 10 Jun 2015 11:33:32 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 824B112E6
 for <freebsd-ports-bugs@FreeBSD.org>; Wed, 10 Jun 2015 11:33:32 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t5ABXWIV005233
 for <freebsd-ports-bugs@FreeBSD.org>; Wed, 10 Jun 2015 11:33:32 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-ports-bugs@FreeBSD.org
Subject: [Bug 200759] sysutils/logstash: Security vulnerability CVE-2015-4152
Date: Wed, 10 Jun 2015 11:33:32 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Ports & Packages
X-Bugzilla-Component: Individual Port(s)
X-Bugzilla-Version: Latest
X-Bugzilla-Keywords: needs-patch, security
X-Bugzilla-Severity: Affects Only Me
X-Bugzilla-Who: koobs@FreeBSD.org
X-Bugzilla-Status: New
X-Bugzilla-Priority: ---
X-Bugzilla-Assigned-To: freebsd-ports-bugs@FreeBSD.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: maintainer-feedback?
X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform
 bug_file_loc op_sys bug_status keywords bug_severity priority component
 assigned_to reporter cc flagtypes.name
Message-ID: <bug-200759-13@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-ports-bugs@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Ports bug reports <freebsd-ports-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-ports-bugs>, 
 <mailto:freebsd-ports-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports-bugs/>
List-Post: <mailto:freebsd-ports-bugs@freebsd.org>
List-Help: <mailto:freebsd-ports-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>, 
 <mailto:freebsd-ports-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 10 Jun 2015 11:33:32 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=200759

            Bug ID: 200759
           Summary: sysutils/logstash: Security vulnerability
                    CVE-2015-4152
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: http://www.securityfocus.com/archive/1/535725/30/0/thr
                    eaded
                OS: Any
            Status: New
          Keywords: needs-patch, security
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: freebsd-ports-bugs@FreeBSD.org
          Reporter: koobs@FreeBSD.org
                CC: enrico.m.crisostomo@gmail.com,
                    ports-secteam@FreeBSD.org
             Flags: maintainer-feedback?(enrico.m.crisostomo@gmail.com)
                CC: enrico.m.crisostomo@gmail.com

Logstash versions 1.4.2 and prior are vulnerable to a directory traversal
attack that allows an attacker to over-write files on the server running
Logstash.

This vulnerability is not present in the initial installation of Logstash. The
vulnerability is exposed when the file output plugin is configured for use. The
files impacted must be writeable by the user that owns the Logstash process.

-- 
You are receiving this mail because:
You are the assignee for the bug.