Description

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged.

Remediation

References

https://www.elastic.co/community/security

https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777

Related Vulnerabilities

CVE-2018-15494 Vulnerability in npm package dojox

CVE-2017-3160 Vulnerability in npm package cordova-android

CVE-2015-5349 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.plugins-parent

CVE-2017-5637 Vulnerability in maven package org.apache.zookeeper:zookeeper

CVE-2013-2055 Vulnerability in maven package org.apache.wicket:wicket

Severity

Critical

Classification

CWE-532 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory