Description

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged.

Remediation

References

https://www.elastic.co/community/security

https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777

Related Vulnerabilities

CVE-2020-2254 Vulnerability in maven package io.jenkins.blueocean:blueocean-parent

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

CVE-2018-1000130 Vulnerability in maven package org.jolokia:jolokia-core

CVE-2022-0084 Vulnerability in maven package org.jboss.xnio:xnio-api

CVE-2020-2132 Vulnerability in maven package com.parasoft:environment-manager

Severity

Critical

Classification

CWE-532 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory