search-guard: authenticated users can gain read access to data they are not authorized to see
Published Aug 13, 2019
6.5
MEDIUMCVSS 3.1
EPSS 0.99%
Description
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.
Affected products
-
- Version before 24.3StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Floragunn | Search Guard | n/a |
|
- < 24.3
No data.
Red Hat OpenShift Container Platform 3.10
openshift-elasticsearch-plugin
Fix deferred
Red Hat OpenShift Container Platform 3.11
openshift3/ose-logging-elasticsearch5
Fix deferred
Red Hat OpenShift Container Platform 3.9
openshift-elasticsearch-plugin
Fix deferred
Red Hat OpenShift Container Platform 3.9
search-guard-2
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-logging-elasticsearch5
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | openshift-elasticsearch-plugin | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-elasticsearch5 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 3.9 | openshift-elasticsearch-plugin | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 3.9 | search-guard-2 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-logging-elasticsearch5 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (7)
- https://access.redhat.com/security/cve/CVE-2019-13415 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1758535 Issue Tracking
- https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3 x_refsource_CONFIRMRelease NotesVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4909 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-13415
- https://search-guard.com/cve-advisory/ x_refsource_MISCVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-13415
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-13415 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1758535 | Issue Tracking | |
| https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3 | x_refsource_CONFIRMRelease NotesVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4909 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-13415 | ||
| https://search-guard.com/cve-advisory/ | x_refsource_MISCVendor Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-13415 |
Change history (0)
No recorded changes yet.