Homepage About Snyk

Cryptographic Issues Affecting github.com/elastic/cloud-on-k8s Open this link in a new tab package, versions <1.1.0

0.0
high

  • Attack Complexity

    High

  • Confidentiality

    High

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-GOLANG-GITHUBCOMELASTICCLOUDONK8S-571293

  • published

    4 Jun 2020

  • disclosed

    4 Jun 2020

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 4 Jun 2020

CVE-2020-7010 Open this link in a new tab
CWE-310 Open this link in a new tab

How to fix?

Upgrade github.com/elastic/cloud-on-k8s to version 1.1.0 or higher.

Overview

github.com/elastic/cloud-on-k8s is a package that automates the deployment, provisioning, management, and orchestration of Elasticsearch, Kibana and APM Server on Kubernetes based on the operator pattern.

Affected versions of this package are vulnerable to Cryptographic Issues. A weak random number generator is used for generating passwords. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.