CVE-2017-8438: High severity elastic vulnerability

Published Jun 5, 2017

Updated

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas will be incorrect. Additionally if the runas user specified does not exist, the transition will not happen.

Affected Software

13 affected components

Elastic X-Pack=5.0.0

Elastic X-Pack=5.0.1

Elastic X-Pack=5.0.2

Elastic X-Pack=5.1.0

Elastic X-Pack=5.1.1

Elastic X-Pack=5.2.0

Elastic X-Pack=5.2.1

Elastic X-Pack=5.2.2

Elastic X-Pack=5.3.0

Elastic X-Pack=5.3.1

Elastic X-Pack=5.3.2

Elastic X-Pack=5.3.3

Elastic X-Pack=5.4.0

Remediation

Patch Available

https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released

Event History

Jun 5, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-8438?

CVE-2017-8438 is considered a high severity vulnerability due to its potential for privilege escalation.

Which versions of Elastic X-Pack are affected by CVE-2017-8438?

CVE-2017-8438 affects Elastic X-Pack versions from 5.0.0 to 5.4.0.

How do I fix CVE-2017-8438?

To fix CVE-2017-8438, upgrade to Elastic X-Pack version 5.4.1 or later, where the vulnerability is addressed.

What type of bug is described in CVE-2017-8438?

CVE-2017-8438 describes a privilege escalation bug related to the run_as functionality in Elastic X-Pack.

What might happen if I don't mitigate CVE-2017-8438?

Failing to mitigate CVE-2017-8438 could allow unauthorized users to gain elevated privileges within the Elastic Stack.