https://bugzilla.redhat.com/show_bug.cgi?id=1747240
Bug ID: 1747240
Summary: CVE-2019-7614 elasticsearch: Race condition in
response headers on systems with multiple submitting
requests
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: ahardin(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
bazanluis20(a)gmail.com, bleanhar(a)redhat.com,
bobjensen(a)gmail.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
dedgar(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ggaughan(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jschluet(a)redhat.com, jvanek(a)redhat.com,
kbasil(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lpetrovi(a)redhat.com, mburns(a)redhat.com,
mchappel(a)redhat.com, mmagr(a)redhat.com,
mnovotny(a)redhat.com, pahan(a)hubbitus.info,
paradhya(a)redhat.com, rrajasek(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, slinaber(a)redhat.com,
zbyszek(a)in.waw.pl
Target Milestone: ---
Classification: Other
A race condition flaw was found in the response headers Elasticsearch versions
before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users
submitting requests, it could be possible for an attacker to gain access to
response header containing sensitive data from another user.
References:
https://www.elastic.co/pt/community/security/
--
You are receiving this mail because:
You are on the CC list for the bug.