https://bugzilla.redhat.com/show_bug.cgi?id=1764751
Bug ID: 1764751
Summary: CVE-2019-7619 elasticsearch: Username disclosure in
API Key service
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, aos-bugs(a)redhat.com,
bazanluis20(a)gmail.com, bmontgom(a)redhat.com,
bobjensen(a)gmail.com, chazlett(a)redhat.com,
drieden(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jstastny(a)redhat.com, jvanek(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
mnovotny(a)redhat.com, nstielau(a)redhat.com,
pahan(a)hubbitus.info, paradhya(a)redhat.com,
rmeggins(a)redhat.com, rrajasek(a)redhat.com,
rsynek(a)redhat.com, sdaley(a)redhat.com,
sponnaga(a)redhat.com, zbyszek(a)in.waw.pl
Target Milestone: ---
Classification: Other
A username disclosure flaw was found in Elasticsearch’s API Key service. An
unauthenticated attacker could send a specially crafted request and determine
if a username exists in the Elasticsearch native realm.
References:
https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908
--
You are receiving this mail because:
You are on the CC list for the bug.