Description
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Elasticsearch | before 7.2.1 and 6.8.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | < 6.8.2 | 6.8.2 | GHSA-jqm6-m3j3-8gg9 |
| Maven | org.elasticsearch:elasticsearch | >= 7.0.0, < 7.2.1 | 7.2.1 | GHSA-jqm6-m3j3-8gg9 |
Advisories 1
- WID-SEC-2024-3184 Elasticsearch/Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024