Security Bulletin: Ansible vulnerability affects IBM Elastic Storage System (CVE-2021-3583)

Summary IBM Elastic Storage System is shipped with ansible, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2021-3583 DESCRIPTION: Ansible could allow a local authenticated attacker to execute arbitrary commands on the system, caused by template injecti...

Security Bulletin: glibc vulnerability affects IBM Elastic Storage System (CVE-2021-27645)

Summary IBM Elastic Storage System is shipped with GNU glibc, for which a fix is available for a security vulnerability. Vulnerability Details CVEID:CVE-2021-27645 DESCRIPTION: GNU glibc is vulnerable to a denial of service, caused by double-free in the nameserver caching daemon nscd. By sending ...

App Layering - User's not getting assigned app layers at login - Elastic layer assignment JSON files changing or being reset to default

Users with elastically assigned app layers do not have those app layers showing up at login. Elastic layering assignment files are changing on the network share used for elastic app layers. Layers.json ElasticLayerAssignments.json...

Cryptographic Issues in ECK

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

GO-2022-0643 Denial of service in github.com/elastic/beats

A local attacker can cause a panic if they are able to send arbitrary traffic to a monitored port, due to an out of bounds read...

GHSA-VFP4-XX6M-7VF6 Cryptographic Issues in ECK

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

Elastic: CSRF in AppSearch allows creation of "curations"

Summary Hello team! The curations creation for AppSearch engines can happen on a GET request which means there's no CSRF protection. Steps to reproduce 1. In one tab visit this page on my Elastic Cloud instance:...

Elastic Kibana XSS Vulnerability (ESA-2022-01)

Elastic Kibana is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

AWS Elastic Beanstalk Dockerrun Detected

AWS Elastic Beanstalk is a Platform-as-a-Service PaaS feature provided by Amazon Web Services which allows developers to quickly deploy their web applications in various predefined environments Java, .NET, PHP... without managing the underlying infrastructure configuration. AWS Elastic Beanstalk...

Adobe Acrobat PDF Maker Outlook Add-in not working when elastically layered.

Outlook add-in not working for Adobe PDF Maker. Attempting use Adobe Acrobat Reader and Acrobat Pro with one on the base image and the other as an elastic layer...

Moderate: Red Hat Security Advisory: Red Hat Data Grid 8.2.3 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Security Bulletin: Multiple vulnerabilities in Apache Log4j impact IBM Elastic Storage System (CVE-2021-45105, CVE-2021-45046)

Summary Vulnerabilities in Apache Log4j could allow an attacker to execute arbitrary code and denial of service on the system. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale for logging which is bundled in IBM Elastic Storage System. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in Apache Log4j impact IBM Spectrum Scale for IBM Elastic Storage Server (CVE-2021-45105,CVE-2021-45046)

Summary Multiple vulnerabilities in Apache Log4j could allow an attacker to execute arbitrary code and denial of service on the system. These vulnerabilities may affect IBM Spectrum Scale For IBM Elastic Storage Server because the library is used by the Graphical User Interface GUI of IBM Spectru...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Elastic Storage System (CVE-2021-44228)

Summary A vulnerability in Apache Log4j CVE-2021-44228 could allow an attacker to execute arbitrary code on the system. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale for logging and it is bundled in IBM Elastic Storage System ESS. This vulnerability may affect IBM...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Scale for IBM Elastic Storage Server (CVE-2021-44228)

Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale for IBM Elastic Storage Server for logging . This vulnerability may affect IBM Spectrum Scale for IBM Elastic...

Security Bulletin: There is a vulnerability in the systemd used in IBM Elastic Storage System

Summary There is a security vulnerability in versions of systemd that are shipped with versions of IBM Elastic Storage System. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2021-33910 DESCRIPTION: Systemd is vulnerable to a denial of service, caused by a memory...

Security Bulletin: There are multiple vulnerabilities in the Linux Kernel used in IBM Elastic Storage System

Summary There are security vulnerabilities in versions of Linux Kernel that are shipped with versions of IBM Elastic Storage System. A fix for these vulnerabilities is available. Vulnerability Details CVEID: CVE-2020-35508 DESCRIPTION: Linux Kernel could allow a local attacker to bypass security...

Elastic Logstash Multiple Log4j Vulnerabilities (Dec 2021)

Elastic Logstash is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Bulletin: Vulnerability in Apache Log4j affects the components (Elastic Search and Hadoop) of IBM Financial Crimes Insight for Claims Fraud

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Financial Crimes Insight for Claims Fraud for generating logs in some of its components. This bulletin provides mitigations for the Log4Shell vulnerability CVE-2021-44228 by applying the applicable workaround ste...

MTN Group: Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228

The vulnerability CVE-2021-44228, a remote code injection flaw in Log4j, was discovered on the website http://mtn1app.mtncameroon.net. The vulnerability was confirmed to be present on the ports 8080 and 8443 of the website. The issue was demonstrated by retrieving the hostname of the affected...