https://bugzilla.redhat.com/show_bug.cgi?id=1632452
Bug ID: 1632452
Summary: CVE-2018-3831 elasticsearch: Information exposure via
_cluster/settings API
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: ahardin(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bkearney(a)redhat.com, bleanhar(a)redhat.com,
bobjensen(a)gmail.com, cbillett(a)redhat.com,
ccoleman(a)redhat.com, chrisw(a)redhat.com,
dedgar(a)redhat.com, emmanuel(a)seyman.fr,
eparis(a)redhat.com, etirelli(a)redhat.com,
hghasemb(a)redhat.com, ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jjoyce(a)redhat.com,
jokerman(a)redhat.com, jschluet(a)redhat.com,
jvanek(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
mchappel(a)redhat.com, mmagr(a)redhat.com,
mmccune(a)redhat.com, mrike(a)redhat.com,
ohadlevy(a)redhat.com, pahan(a)hubbitus.info,
paradhya(a)redhat.com, pszubiak(a)redhat.com,
rbryant(a)redhat.com, rchan(a)redhat.com,
rjerrido(a)redhat.com, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rzhang(a)redhat.com,
sclewis(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, tdecacqu(a)redhat.com,
tjay(a)redhat.com, tomckay(a)redhat.com, zbyszek(a)in.waw.pl
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have
an information disclosure issue when secrets are configured via the API. The
Elasticsearch _cluster/settings API, when queried, could leak sensitive
configuration information such as passwords, tokens, or usernames. This could
allow an authenticated Elasticsearch user to improperly view these details.
--
You are receiving this mail because:
You are on the CC list for the bug.