CVE-2023-6687: Elastic Agent Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6687?
The severity of CVE-2023-6687 is classified as moderate due to potential information disclosure through logging raw event data.
How do I fix CVE-2023-6687?
To fix CVE-2023-6687, upgrade Elastic Agent to a version beyond 8.11.3 or 7.17.16.
What versions of Elastic Agent are affected by CVE-2023-6687?
CVE-2023-6687 affects Elastic Agent versions from 7.0.0 to 7.17.16 and from 8.0.0 to 8.11.3.
What types of events trigger warnings or errors in CVE-2023-6687?
CVE-2023-6687 triggers warnings or errors when Elastic Agent fails to ingest events to Elasticsearch with a 4xx HTTP status code, except for 409 or 429.
Is there a workaround for CVE-2023-6687?
Currently, the recommended solution for CVE-2023-6687 is to upgrade to a patched version, with no official workaround provided.