Elastic Docker Images
Monthly
Elastic Docker images ship an operating-system certificate bundle whose trust anchors lead to eight eMudhra intermediate CAs with compromised private keys, enabling a network-positioned attacker who holds one of those keys to forge a certificate for any hostname these products trust and intercept or modify TLS traffic. The affected Docker builds cover APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent including Fleet Server and Cloudbeat; Logstash; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server when TLS validation uses the OS bundle. Exploitation requires a man-in-the-middle position and key possession; no public exploit code was identified at the time of analysis.
Elastic Docker images ship an operating-system certificate bundle whose trust anchors lead to eight eMudhra intermediate CAs with compromised private keys, enabling a network-positioned attacker who holds one of those keys to forge a certificate for any hostname these products trust and intercept or modify TLS traffic. The affected Docker builds cover APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent including Fleet Server and Cloudbeat; Logstash; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server when TLS validation uses the OS bundle. Exploitation requires a man-in-the-middle position and key possession; no public exploit code was identified at the time of analysis.