Skip to content

Conversation

@jasnow
Copy link
Contributor

@jasnow jasnow commented Apr 15, 2025

GHSA SYNC: 2 brand new advisories:

@postmodern postmodern merged commit 6140107 into rubysec:master Apr 15, 2025
1 check passed
@jnq-t
Copy link

jnq-t commented Apr 15, 2025

Hello @jasnow @postmodern,

Several developers in my organization are not able to bundle update to the latest logstash-event gem. Rubygems doesn’t list anything newer than 1.2.02. Could we get some context?

@fred-brightwheel
Copy link

Unclear as to why logstash-event is included in the GHSA db. Seems like the CVE affects a really old version of logstash. Could be a mistake in GHSA 🤷

@abMatGit
Copy link

abMatGit commented Apr 15, 2025

Agreed -- This looks like a mistake. The CVE is regarding logstash version, not this gem which just does formatting.

postmodern added a commit that referenced this pull request Apr 16, 2025
* The original blog post [1] mentions the elasticsearch/logstash-contrib [2]
  github repository, *not* the logstash-event gem which also does not
  appear to contain the mentioned vulnerable files.

[1]: https://web.archive.org/web/20140804031140/http://www.elasticsearch.org/blog/logstash-1-4-2
[2]: https://github.com/elastic/logstash-contrib
@postmodern
Copy link
Member

I have temporarily removed gems/logstash-event/CVE-2014-4326.yml. This does indeed look like incorrect GHSA data. The original blog post mentions the elasticsearch/logstash-contrib GitHub repository, which contains a logstash-contrib.gemspec but doesn't appear to have ever been released to rubygems.org. Also, the logstash-event gem does not contain the mentioned vulnerable files (lib/logstash/outputs/zabbix.rb and lib/logstash/outputs/nagios_nsca.rb).

$ gem unpack logstach-event
$ tree logstash-event-1.2.02/
logstash-event-1.2.02/
├── lib
│   ├── logstash
│   │   ├── event.rb
│   │   ├── namespace.rb
│   │   ├── util
│   │   │   └── fieldreference.rb
│   │   └── util.rb
│   └── logstash-event.rb
├── LICENSE
└── spec
    └── event.rb

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants