Skip to content
OpenAdvisories

Package · Maven

org.opensearch.plugin:opensearch-security

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.2
    GHSA-x5hg-x4gv-j98m

    OpenSearch has ineffective TLS certificate hostname verification

    ### Description A regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecti…

    org.opensearch.plugin:opensearch-security Maven
  • Low 2.2
    GHSA-22vx-2x23-98w6

    OpenSearch vulnerable to improper authorization for Rollover Requests

    ### Description A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the…

    org.opensearch.plugin:opensearch-security Maven
  • Low 3.7
    GHSA-83x9-vc3c-hghc

    OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths

    ### Description A flaw was identified in the OpenSearch REST layer that could allow authorization checks to be bypassed when processing certain malformed HTTP requests. This could permit unauthorized access to restricted API endpoints in environments that rel…

    org.opensearch.plugin:opensearch-security Maven