Description
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Elasticsearch | 7.0.0 – ≤ 7.17.29, 8.0.0 – ≤ 8.18.7, 8.19.0 – ≤ 8.19.4, 9.0.0 – ≤ 9.0.7, 9.1.0 – ≤ 9.1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | elasticsearch | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruby3.2-elasticsearch +2 | 9.2.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.elasticsearch.plugin:reindex-client | >= 7.0.0, < 8.18.8 | 8.18.8 | GHSA-56r7-h6mw-rcfv |
| Maven | org.elasticsearch.plugin:reindex-client | >= 8.19.0, < 8.19.5 | 8.19.5 | GHSA-56r7-h6mw-rcfv |
| Maven | org.elasticsearch.plugin:reindex-client | >= 9.0.0-beta1, < 9.0.8 | 9.0.8 | GHSA-56r7-h6mw-rcfv |
| Maven | org.elasticsearch.plugin:reindex-client | >= 9.1.0, < 9.1.5 | 9.1.5 | GHSA-56r7-h6mw-rcfv |
Advisories 1
- WID-SEC-2025-2217 Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 12, 2025