CVE-2023-23613

OpenSearch is an open source distributed and RESTful search engine. In
affected versions there is an issue in the implementation of field-level
security (FLS) and field masking where rules written to explicitly exclude
fields are not correctly applied for certain queries that rely on their
auto-generated .keyword fields. This issue is only present for
authenticated users with read access to the indexes containing the
restricted fields. This may expose data which may otherwise not be
accessible to the user. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are
affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. Users
unable to upgrade may write explicit exclusion rules as a workaround.
Policies authored in this way are not subject to this issue.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054912&gt;