SB2020102234 - Multiple vulnerabilities in Elasticsearch

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-7020)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to search queries do not properly preserve security permissions when executing certain complex queries. A remote attacker can disclose protected documents when Document or Field Level Security is used.

2) Improper authentication (CVE-ID: CVE-2016-11086)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when validation X.509 certificates in lib/oauth/consumer.rb. The library skips certificate check if the certificate bundle cannot be found on the file system. A remote attacker can bypass authentication based on X.509 certificates using a self-signed certificate.

Remediation

Install update from vendor's website.

References

• https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033
• https://www.elastic.co/community/security#ESA-2020-13
• https://security.netapp.com/advisory/ntap-20201123-0001/