Описание
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
Меры по смягчению последствий
There is no mitigation for this issue, the flaw can only be resolved by applying updates.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Decision Manager 7 | elasticsearch | Fix deferred | ||
| Red Hat Fuse 7 | elasticsearch | Not affected | ||
| Red Hat JBoss Fuse 6 | elasticsearch | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.10 | elasticsearch | Fix deferred | ||
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-elasticsearch5 | Fix deferred | ||
| Red Hat OpenShift Container Platform 3.2 | elasticsearch | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.3 | elasticsearch | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.4 | elasticsearch | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.5 | elasticsearch | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.6 | elasticsearch | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
2 Low
CVSS3
Связанные уязвимости
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
A race condition flaw was found in the response headers Elasticsearch ...
Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch
EPSS
2 Low
CVSS3