CVE-2017-8442: Infoleak
Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8442?
CVE-2017-8442 is considered a high-severity vulnerability due to the potential exposure of sensitive configuration information.
How do I fix CVE-2017-8442?
To fix CVE-2017-8442, upgrade your Elasticsearch X-Pack Security to version 5.4.4 or later.
What information can be leaked in CVE-2017-8442?
CVE-2017-8442 can leak sensitive configuration information such as paths and passphrases of SSL keys.
Who is affected by CVE-2017-8442?
CVE-2017-8442 affects users of Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3 when enabled.
Is authentication necessary to exploit CVE-2017-8442?
Yes, an authenticated user with access to the _nodes API can potentially exploit CVE-2017-8442.