CVE-2021-22138

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Elastic	Elasticsearch	after 6.4.0 and before 6.8.15 and 7.12.0

References

https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125Vendor Advisory
https://security.netapp.com/advisory/ntap-20210629-0001/Third Party Advisory
https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125Vendor Advisory
https://security.netapp.com/advisory/ntap-20210629-0001/Third Party Advisory

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-221396.5Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit CVE-2021-22144.4Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected a CVE-2021-221407.5Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawle CVE-2021-221416.1An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could CVE-2021-221428.8Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user CVE-2021-221434.3The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the AP CVE-2021-221446.5In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was CVE-2021-221456.5A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitr CVE-2021-221467.5All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the defaul CVE-2021-221476.5Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated use CVE-2021-221488.8Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as CVE-2021-221498.8Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alte