Cryptographic Issues Affecting Open this link in a new tab package, versions <1.1.0

  • Attack Complexity


  • Confidentiality


  • Integrity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    4 Jun 2020

  • disclosed

    4 Jun 2020

  • credit


How to fix?

Upgrade to version 1.1.0 or higher.

Overview is a package that automates the deployment, provisioning, management, and orchestration of Elasticsearch, Kibana and APM Server on Kubernetes based on the operator pattern.

Affected versions of this package are vulnerable to Cryptographic Issues. A weak random number generator is used for generating passwords. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.