Moderate: Red Hat Security Advisory: java-11-openjdk security update

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

cn.detachment:detachment-es-example (1.0.2-release), cn.iisme.cloud:iisme-starter-elasticsearch (1.0.1) +187 more potentially affected by CVE-2020-7009 via org.elasticsearch:elasticsearch (>=6.7.0, <=6.8.7)

org.elasticsearch:elasticsearch MAVEN version =6.7.0, =6.7.2, =0.9.0.0, =0.9.0.0, =0.9.0.0, =6.7.0.0, =1.0.0-rc1, =2.1.4, =2.1.12, =6.7.0-33.3, =6.8.6-34.5 and more Source cves: CVE-2020-7009 Source advisory: GHSA-GFV5-GRX2-9JW2...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +348 more potentially affected by CVE-2020-7009 via org.elasticsearch:elasticsearch (>=7.0.0, <=7.6.1)

org.elasticsearch:elasticsearch MAVEN version =7.0.0, =j8.2.2.0, =1.2.1, =1.0.2-release, =0.5.1, =1.0, =7.0.0, =1.0.0.0, =1.0.0.0, =7.0.0, =0.0.1, =0.0.2, =0.0.11, =7.0.0.0, =7.5.1.0 and more Source cves: CVE-2020-7009 Source advisory: OSV:GHSA-GFV5-GRX2-9JW2...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +348 more potentially affected by CVE-2020-7009 via org.elasticsearch:elasticsearch (>=7.0.0, <=7.6.1)

org.elasticsearch:elasticsearch MAVEN version =7.0.0, =j8.2.2.0, =1.2.1, =1.0.2-release, =0.5.1, =1.0, =7.0.0, =1.0.0.0, =1.0.0.0, =7.0.0, =0.0.1, =0.0.2, =0.0.11, =7.0.0.0, =7.5.1.0 and more Source cves: CVE-2020-7009 Source advisory: GHSA-GFV5-GRX2-9JW2...

Security Bulletin: Multiple vulnerabilities affect IBM Observability with Instana

Summary Vulnerabilities detected in Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.2 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2019-7619 DESCRIPTION: Elastic Elasticsearch could allow a remote attacker to obtain sensitive information, caused by a flaw in...

GHSA-7MQR-2V3Q-V2WM Ory fosite contains Improper Handling of Exceptional Conditions

Impact The TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store...

Ory fosite contains Improper Handling of Exceptional Conditions

Impact The TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store...

cn.detachment:detachment-es-example (1.0.2-release), cn.iisme.cloud:iisme-starter-elasticsearch (1.0.1) +187 more potentially affected by CVE-2020-7009 +1 more via org.elasticsearch:elasticsearch (>=6.7.0, <=6.8.7)

org.elasticsearch:elasticsearch MAVEN version =6.7.0, =6.7.2, =0.9.0.0, =0.9.0.0, =0.9.0.0, =6.7.0.0, =1.0.0-rc1, =2.1.4, =2.1.12, =6.7.0-33.3, =6.8.6-34.5 and more Source cves: CVE-2020-7009, CVE-2020-7014 Source advisory: GHSA-HQQV-9X3V-MP7W...

Privilege Escalation Flaw in Elasticsearch

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +348 more potentially affected by CVE-2020-7009 +1 more via org.elasticsearch:elasticsearch (>=7.0.0, <=7.6.1)

org.elasticsearch:elasticsearch MAVEN version =7.0.0, =j8.2.2.0, =1.2.1, =1.0.2-release, =0.5.1, =1.0, =7.0.0, =1.0.0.0, =1.0.0.0, =7.0.0, =0.0.1, =0.0.2, =0.0.11, =7.0.0.0, =7.5.1.0 and more Source cves: CVE-2020-7009, CVE-2020-7014 Source advisory: GHSA-HQQV-9X3V-MP7W...

Security Bulletin: Multiple vulnerabilities in middleware software affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to the WebSphere Liberty server, to Node.js runtime and modules and to other open source packages. Vulnerability Details CVEID: CVE-2019-7619 DESCRIPTION: Elastic Elasticsearch could allow a remote attacker to obtain sensitive information, caused by a flaw ...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Elastic Elasticsearch

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Elastic Elasticsearch. Vulnerability Details CVEID: CVE-2020-7009 DESCRIPTION: Elastic Elasticsearch could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw in...

CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +348 more potentially affected by CVE-2020-7009 +1 more via org.elasticsearch:elasticsearch (>=7.0.0, <=7.6.1)

org.elasticsearch:elasticsearch MAVEN version =7.0.0, =j8.2.2.0, =1.2.1, =1.0.2-release, =0.5.1, =1.0, =7.0.0, =1.0.0.0, =1.0.0.0, =7.0.0, =0.0.1, =0.0.2, =0.0.11, =7.0.0.0, =7.5.1.0 and more Source cves: CVE-2020-7009, CVE-2020-7014 Source advisory: MEND:CVE-2020-7014...

cn.detachment:detachment-es-example (1.0.2-release), cn.iisme.cloud:iisme-starter-elasticsearch (1.0.1) +187 more potentially affected by CVE-2020-7009 +1 more via org.elasticsearch:elasticsearch (>=6.7.0, <=6.8.7)

org.elasticsearch:elasticsearch MAVEN version =6.7.0, =6.7.2, =0.9.0.0, =0.9.0.0, =0.9.0.0, =6.7.0.0, =1.0.0-rc1, =2.1.4, =2.1.12, =6.7.0-33.3, =6.8.6-34.5 and more Source cves: CVE-2020-7009, CVE-2020-7014 Source advisory: MEND:CVE-2020-7014...

CVE-2019-7009

...

CVE-2019-7009

CVE-2019-7009 entry is rejected/not used per initial description; does not represent an active vulnerability entry.

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

cn.detachment:detachment-es-example (1.0.2-release), cn.iisme.cloud:iisme-starter-elasticsearch (1.0.1) +187 more potentially affected by CVE-2020-7009 via org.elasticsearch:elasticsearch (>=6.7.0, <=6.8.7)

org.elasticsearch:elasticsearch MAVEN version =6.7.0, =6.7.2, =0.9.0.0, =0.9.0.0, =0.9.0.0, =6.7.0.0, =1.0.0-rc1, =2.1.4, =2.1.12, =6.7.0-33.3, =6.8.6-34.5 and more Source cves: CVE-2020-7009 Source advisory: MEND:CVE-2020-7009...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +348 more potentially affected by CVE-2020-7009 via org.elasticsearch:elasticsearch (>=7.0.0, <=7.6.1)

org.elasticsearch:elasticsearch MAVEN version =7.0.0, =j8.2.2.0, =1.2.1, =1.0.2-release, =0.5.1, =1.0, =7.0.0, =1.0.0.0, =1.0.0.0, =7.0.0, =0.0.1, =0.0.2, =0.0.11, =7.0.0.0, =7.5.1.0 and more Source cves: CVE-2020-7009 Source advisory: MEND:CVE-2020-7009...