CVE-2020-27816: Medium severity elastic vulnerability
In the OpenShift Container Platform 4.x the kibana logging console might be manipulated or even completely damaged by any user who create kibana resource in a non openshift-logging namespace. Due to that the console links is recreated by the elasticsearch-operator based on the new CR. If the new kibana resource is removed then the openshift-logging console link does not back to the original one but completely is lost.
This flaw could lead to an arbitrary URL redirection or the openshift-logging console link full damage.
Other sources
The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27816?
CVE-2020-27816 is a vulnerability in the elasticsearch-operator that allows the replacement of the original openshift-logging console link with a different one.
What is the severity of CVE-2020-27816?
CVE-2020-27816 has a severity value of 6.1, which is considered medium.
How does CVE-2020-27816 impact the elasticsearch-operator?
CVE-2020-27816 allows an attacker to replace the original openshift-logging console link with a different one, posing a potential security risk.
How can I mitigate CVE-2020-27816?
To mitigate CVE-2020-27816, ensure that the elasticsearch-operator validates the namespace where the kibana logging resource is created.
Where can I find more information about CVE-2020-27816?
You can find more information about CVE-2020-27816 on the following sources: [Github PR #581](https://github.com/openshift/elasticsearch-operator/pull/581), [Github PR #587](https://github.com/openshift/elasticsearch-operator/pull/587), [Red Hat Security Advisory RHSA-2021:0310](https://access.redhat.com/errata/RHSA-2021:0310).