CVE-2023-25806: Time discrepancy in authentication responses in OpenSearch
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25806?
CVE-2023-25806 is a vulnerability in OpenSearch Security, a plugin for OpenSearch that offers encryption, authentication, and authorization.
How does CVE-2023-25806 affect me?
CVE-2023-25806 affects you if you are using Amazon Opensearch or Amazon Opensearch Security versions 1.3.9 and below, or versions 2.0.0 to 2.6.0 (inclusive).
What is the severity of CVE-2023-25806?
The severity of CVE-2023-25806 is medium with a severity value of 5.3.
How can I fix CVE-2023-25806?
To fix CVE-2023-25806, update your Amazon Opensearch or Amazon Opensearch Security to versions higher than 2.6.0 or 1.3.9 respectively.
Where can I find more information about CVE-2023-25806?
You can find more information about CVE-2023-25806 on the official GitHub page: [GitHub - OpenSearch Security Advisory](https://github.com/opensearch-project/security/security/advisories/GHSA-c6wg-cm5x-rqvj)