Bug 1226046 (CVE-2024-23445) - VUL-0: CVE-2024-23445: elasticsearch: elasticsearch: Remote Cluster Search Cross Cluster API Key insufficient restrictions
Summary: VUL-0: CVE-2024-23445: elasticsearch: elasticsearch: Remote Cluster Search Cr...
Status: RESOLVED FIXED
Alias: CVE-2024-23445
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/408901/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-23445:6.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-06 14:38 UTC by SMASH SMASH
Modified: 2024-06-06 14:38 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-06 14:38:10 UTC 
Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient
  restrictions (ESA-2024-13)

   It was identified that if a cross-cluster API key restricts search for a
   given index using the query or the field_security parameter, and the same
   cross-cluster API key also grants replication for the same index, the
   search restrictions are not enforced during cross cluster search
   operations and search results may include documents and terms that should
   not be returned.

   This issue only affects the API key based security model for remote
   clusters that was previously a beta feature and is released as GA with
   8.14.0

   We would like to thank René Kalff for bringing this issue to our
   attention.

  Affected Versions:

   Elasticsearch version on or after 8.10.0 and before 8.14.0

  Solutions and Mitigations:

   The issue is resolved in version 8.14.0.

   Severity: CVSSv3: 6.5(Medium) -
   CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

   CVE ID: CVE-2024-23445

   1 post - 1 participant

   Read full topic

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23445
https://bugzilla.redhat.com/show_bug.cgi?id=2290705
Comment 1 Andrea Mattiazzo 2024-06-06 14:38:45 UTC 
Closing as all products are not affected.