csaf_certbund - WID-SEC-W-2024-1739

WID-SEC-W-2024-1739

Vulnerability from csaf_certbund

Published

2024-07-31 22:00

Modified

2024-07-31 22:00

Summary

Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um Informationen offenzulegen.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1739 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1739.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1739 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1739"
      },
      {
        "category": "external",
        "summary": "Elasticsearch Security Update vom 2024-07-31",
        "url": "https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12"
      }
    ],
    "source_lang": "en-US",
    "title": "Elasticsearch: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2024-07-31T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:11:52.760+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1739",
      "initial_release_date": "2024-07-31T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-31T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.17.23",
                "product": {
                  "name": "Open Source Elasticsearch \u003c7.17.23",
                  "product_id": "T036529"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.13.0",
                "product": {
                  "name": "Open Source Elasticsearch \u003c8.13.0",
                  "product_id": "T036530"
                }
              }
            ],
            "category": "product_name",
            "name": "Elasticsearch"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-23444",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Elasticsearch, die auf eine unsachgem\u00e4\u00dfe Handhabung des Verschl\u00fcsselungsprozesses des privaten Schl\u00fcssels zur\u00fcckzuf\u00fchren ist. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen, insbesondere um Zugang zu sensiblen privaten Schl\u00fcsselinformationen zu erhalten, die unverschl\u00fcsselt auf der Festplatte gespeichert sind."
        }
      ],
      "release_date": "2024-07-31T22:00:00.000+00:00",
      "title": "CVE-2024-23444"
    }
  ]
}

cve-2024-23444

Vulnerability from cvelistv5

Published

2024-07-31 17:26

Modified

2024-07-31 18:45

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

References

▼	URL	Tags
	https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157

Impacted products

	Vendor	Product	Version
	Elastic	Elasticsearch	Version: 7.x < 7.17.23 Version: 8.x < 8.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23444",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-31T18:45:22.621905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-31T18:45:42.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Elasticsearch",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThan": "7.17.23",
              "status": "affected",
              "version": "7.x",
              "versionType": "custom"
            },
            {
              "lessThan": "8.13.0",
              "status": "affected",
              "version": "8.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cspan style=\"background-color: transparent;\"\u003eIt was discovered by Elastic engineering that when \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003eelasticsearch-certutil\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e CLI tool is used with the \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003ecsr\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the \u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e--pass\u003c/span\u003e\u003cspan style=\"background-color: transparent;\"\u003e parameter is passed in the command invocation.\u003c/span\u003e\u003c/b\u003e\u003cbr\u003e"
            }
          ],
          "value": "It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311 Missing Encryption of Sensitive Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-31T17:26:12.784Z",
        "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "shortName": "elastic"
      },
      "references": [
        {
          "url": "https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Elasticsearch elasticsearch-certutil csr fails to encrypt private key",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
    "assignerShortName": "elastic",
    "cveId": "CVE-2024-23444",
    "datePublished": "2024-07-31T17:26:12.784Z",
    "dateReserved": "2024-01-16T21:31:26.029Z",
    "dateUpdated": "2024-07-31T18:45:42.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted