elasticsearch: Information exposure via _cluster/settings API

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This...

Important: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

A minor version update from 7.6 to 7.7 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2020-49490)

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A cross-site scripting vulnerability exists in Elasticsearch Kibana versions prior to 6.8.11 and prior to 7.8.1. The vulnerability stems from the WEB...

Elasticsearch Privilege Escalation (CVE-2020-7009)

A privilege escalation vulnerability exists in Elasticsearch. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

Elasticsearch MachineLearning XML External Entities (CVE-2018-17247)

An XML external entities vulnerability exists in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the...

Elasticsearch Kibana Resource Management Error Vulnerability

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A security vulnerability exists in Elasticsearch Kibana versions prior to 6.8.11 and prior to 7.8.1. An attacker can exploit the vulnerability with the...

Leak Exposes Private Data of Genealogy Service Users

A server containing information of users of a genealogy service has exposed the data of 60,000 users, putting them at risk for fraud, phishing and other cybercriminal activity. Research led by Avishai Efrat at WizCase has discovered the leak, which affected an open and unencrypted ElasticSearch...

Kibana Elasticsearch Server Side Request Forgery (CVE-2019-7616)

A server side request forgery vulnerability exists in Kibana Elasticsearch. Successful exploitation of this vulnerability could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system...

Photon OS 2.0: Elasticsearch PHSA-2020-2.0-0253

An update of the elasticsearch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0253. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

CVE-2020-7011

A flaw was found in elasticsearch. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim's web browser...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Elastic Elasticsearch

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Elastic Elasticsearch. Vulnerability Details CVEID: CVE-2020-7009 DESCRIPTION: Elastic Elasticsearch could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw in...

Photon OS 1.0: Elasticsearch PHSA-2020-1.0-0301

An update of the elasticsearch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0301. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0301

An update of 'systemd', 'openssh', 'expat', 'perl', 'elasticsearch', 'kibana' packages of Photon OS has been released...

GHSA-MVR2-9PJ6-7W5J vulnerabilities

Vulnerabilities for packages: spark-fips, druid, hadoop-fips, spark...

Important Photon OS Security Update - PHSA-2020-0253

Updates of 'kibana', 'elasticsearch', 'openssh' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0253

An update of 'kibana', 'elasticsearch', 'openssh' packages of Photon OS has been released...

Important Photon OS Security Update - PHSA-2020-3.0-0103

Updates of 'linux-aws', 'systemd', 'openssh', 'linux', 'glib-networking', 'elasticsearch', 'linux-secure', 'linux-esx', 'kibana', 'glibc', 'gnutls' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-0103

Updates of 'kibana', 'glib-networking', 'glibc', 'linux-esx', 'openssh', 'systemd', 'linux', 'elasticsearch', 'linux- secure', 'linux-aws', 'gnutls' packages of Photon OS have been released...

Elasticsearch Kibana Cross-Site Scripting Vulnerability (CNVD-2020-38067)

Elasticsearch Kibana is a suite of open source, browser-based analytics and search Elasticsearch dashboard tools from Elasticsearch Netherlands. A cross-site scripting vulnerability exists in Elasticsearch Kibana versions prior to 6.8.9 and prior to 7.7.0. The vulnerability stems from the WEB...