org.opensearch.plugin:opensearch-security@2.1.0.0 vulnerabilities
latest version
2.18.0.0
latest non vulnerable version
first published
2 years ago
latest version published
2 months ago
licenses detected
- [2.1.0.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.opensearch.plugin:opensearch-security package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') through the HTTP layer, an attacker can force an OpenSearch node to exit with an How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')? Upgrade | [,1.3.14)[2.0.0,2.11.0) |
Affected versions of this package are vulnerable to Improper Preservation of Permissions in the implementation of tenant permissions in OpenSearch Dashboards. An attacker can perform create, edit, and delete operations on index metadata of dashboards and visualizations in a tenant, potentially rendering them unavailable, by exploiting the fact that authenticated users with read-only access to a tenant are not properly restricted. How to fix Improper Preservation of Permissions? Upgrade | [,2.11.0.0) |
Affected versions of this package are vulnerable to Incorrect Authorization due to an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions. Note: For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. How to fix Incorrect Authorization? Upgrade | [2.0.0,2.7.0.0) |
Affected versions of this package are vulnerable to Timing Attack in the authentication response time, which is different for existing and not-existing users. Note: This issue only affects calls using the internal basic identity provider (IdP), not other externally configured IdPs. How to fix Timing Attack? Upgrade | [,1.3.9)[2.0.0,2.6.0) |
Affected versions of this package are vulnerable to Improper Authorization of Index Containing Sensitive Information in the implementation of fine-grained access control rules (document-level security, field-level security, and field masking), where they are not correctly applied to the indices that back data streams. Note: Exploiting this vulnerability is possible by authenticated users authorized to read those data streams which are backed by the impacted indexes. Additionally, existing privileged users cannot access random indexes within these clusters; they can only access indexes to which they have already been granted permission. How to fix Improper Authorization of Index Containing Sensitive Information? Upgrade | [,1.3.7)[2.0.0,2.4.0) |
Affected versions of this package are vulnerable to Information Exposure. Requests to an OpenSearch cluster configured with advanced access control features - document level security (DLS), field level security (FLS), and/or field masking - will not be filtered when the query's search pattern matches an aliased index. This allows requests to access sensitive information when customer have acted to restrict access that specific information. How to fix Information Exposure? Upgrade | [,2.2.0.0) |