search-guard: authenticated users ignoring their roles on the remote cluster
Published Aug 13, 2019
6.5
MEDIUMCVSS 3.1
EPSS 0.99%
Description
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).
Affected products
-
- Version before 24.3StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Floragunn | Search Guard | n/a |
|
- < 24.3
No data.
Red Hat OpenShift Container Platform 3.10
openshift-elasticsearch-plugin
Fix deferred
Red Hat OpenShift Container Platform 3.11
openshift3/ose-logging-elasticsearch5
Fix deferred
Red Hat OpenShift Container Platform 3.9
openshift-elasticsearch-plugin
Fix deferred
Red Hat OpenShift Container Platform 3.9
search-guard-2
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-logging-elasticsearch5
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | openshift-elasticsearch-plugin | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-elasticsearch5 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 3.9 | openshift-elasticsearch-plugin | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 3.9 | search-guard-2 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-logging-elasticsearch5 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (7)
- https://access.redhat.com/security/cve/CVE-2019-13416 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1758313 Issue Tracking
- https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3 x_refsource_CONFIRMRelease NotesVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4910 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-13416
- https://search-guard.com/cve-advisory/ x_refsource_MISCVendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-13416
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-13416 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1758313 | Issue Tracking | |
| https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3 | x_refsource_CONFIRMRelease NotesVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4910 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-13416 | ||
| https://search-guard.com/cve-advisory/ | x_refsource_MISCVendor Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-13416 |
Change history (0)
No recorded changes yet.