CVE-2021-22143: Elastic APM .NET Agent information disclosure
First published: Wed Nov 22 2023(Updated: )
The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.
Credit: bressers@elastic.co bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Elastic APM .NET Agent | <1.10.0 | |
| nuget/Elastic.Apm | <1.10.0 | 1.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668
- https://www.elastic.co/community/security
- https://nvd.nist.gov/vuln/detail/CVE-2021-22143
- https://github.com/elastic/apm-agent-dotnet/pull/1286
- https://github.com/elastic/apm-agent-dotnet/commit/c2b519aaa0fe5e5044b736cfec695342f124bf30
- https://github.com/advisories/GHSA-hx93-gc73-5rpr (Advisory)
Frequently Asked Questions
What is CVE-2021-22143?
CVE-2021-22143 is a vulnerability that allows the Elastic APM .NET Agent to leak sensitive HTTP header information during an application error.
How does CVE-2021-22143 affect me?
If you are using the Elastic APM .NET Agent version up to and excluding 1.10.0, your sensitive HTTP header information may be leaked during an application error.
What is the severity of CVE-2021-22143?
CVE-2021-22143 has a severity level of low with a CVSS score of 2.1.
How can I fix CVE-2021-22143?
To fix CVE-2021-22143, update your Elastic APM .NET Agent to version 1.10.0 or higher.
Where can I find more information about CVE-2021-22143?
You can find more information about CVE-2021-22143 on the Elastic community security page, the National Vulnerability Database (NVD), and the Elastic Discuss forum.
- collector/nvd-cve
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-hx93-gc73-5rpr
- alias/CVE-2021-22143
- collector/github-advisory
- agent/references
- agent/author
- agent/type
- agent/title
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- vendor/elastic
- canonical/elastic apm .net agent
- package-manager/nuget