https://bugzilla.redhat.com/show_bug.cgi?id=1696034
Bug ID: 1696034
Summary: CVE-2019-7611 elasticsearch: Improper permission issue
when attaching a new name to an index
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190219,reported=20190219,sour
ce=cve,cvss3=6.8/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/
I:H/A:N,cwe=CWE-285,openshift-enterprise-3.11/elastics
earch=new,openshift-enterprise-3.10/elasticsearch=new,
openshift-enterprise-3.9/elasticsearch=new,openshift-e
nterprise-3.7/elasticsearch=new,openshift-enterprise-3
.6/elasticsearch=new,openshift-enterprise-3.1/elastics
earch=new,openshift-enterprise-3.0/elasticsearch=new,o
penstack-8-optools/elasticsearch=new,openshift-enterpr
ise-3.5/elasticsearch=new,openshift-enterprise-3.4/ela
sticsearch=new,openshift-enterprise-3.3/elasticsearch=
new,openshift-enterprise-3.2/elasticsearch=new,opensta
ck-9-optools/elasticsearch=new,fedora-all/elasticsearc
h=affected,sam-1/elasticsearch=new,fuse-7/elasticsearc
h=new,rhdm-7/elasticsearch=new,fuse-6/elasticsearch=ne
w,rhpam-7/elasticsearch=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: ahardin(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, bkearney(a)redhat.com,
bleanhar(a)redhat.com, bobjensen(a)gmail.com,
cbillett(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
dedgar(a)redhat.com, emmanuel(a)seyman.fr,
eparis(a)redhat.com, etirelli(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jjoyce(a)redhat.com,
jokerman(a)redhat.com, jschluet(a)redhat.com,
jvanek(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com,
mburns(a)redhat.com, mchappel(a)redhat.com,
mmagr(a)redhat.com, pahan(a)hubbitus.info,
paradhya(a)redhat.com, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rzhang(a)redhat.com,
sclewis(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, tomckay(a)redhat.com,
zbyszek(a)in.waw.pl
Target Milestone: ---
Classification: Other
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1
when Field Level Security and Document Level Security are disabled and the
_aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file
has xpack.security.dls_fls.enabled set to false, certain permission checks are
skipped when users perform one of the actions mentioned above, to make existing
data available under a new index/alias name. This could result in an attacker
gaining additional permissions against a restricted index.
References:
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-upda...
--
You are receiving this mail because:
You are on the CC list for the bug.