GHSA-5FVX-2JJ3-6MFF中危已审查

Insufficiently Protected Credentials in Elasticsearch

OSV 1.4.0 · github-reviewed · 修改于 2021-03-16 09:19

发布时间

2021-03-19 03:27

GitHub 审查时间

2021-03-16 09:19

NVD 发布时间

2021-01-15 04:15

源文件

advisories/github-reviewed/2021/03/GHSA-5fvx-2jj3-6mff/GHSA-5fvx-2jj3-6mff.json

公告说明

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2

受影响的软件包

Maven

org.elasticsearch:elasticsearch

ECOSYSTEM

引入7.7.0修复7.10.2

标识信息

别名 / CVE

CVE-2021-22132

CWE

CWE-522

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-5fvx-2jj3-6mff",
  "aliases": [
    "CVE-2021-22132"
  ],
  "details": "Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2",
  "summary": "Insufficiently Protected Credentials in Elasticsearch",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "7.7.0"
            },
            {
              "fixed": "7.10.2"
            }
          ]
        }
      ],
      "package": {
        "name": "org.elasticsearch:elasticsearch",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2021-03-16T01:19:41Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2021-03-18T19:27:27Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22132",
      "type": "ADVISORY"
    },
    {
      "url": "https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164",
      "type": "WEB"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210219-0004",
      "type": "WEB"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2021-01-14T20:15:00Z",
    "github_reviewed_at": "2021-03-16T01:19:41Z"
  }
}