CVE-2017-8444 - The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper

Back Back to CVE browser

MEDIUM

The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper

Published Sep 28, 2017

5.9

MEDIUM

CVSS 3.0

EPSS 0.57%

Description

The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle (MITM) the traffic between the client-forwarder and ZooKeeper they could potentially obtain sensitive data.

Affected products

Vendor Elastic Product Elastic Cloud Enterprise Default
n/a
- Version
  1.0.0 and 1.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Elastic

Elastic Cloud Enterprise

n/a

Version	Status	Constraints
1.0.0 and 1.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-319

References (2)

https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-17395
Advisory

Link	Providers	Tags
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-17395		Advisory