Insertion of Sensitive Information into Log File Affecting org.elasticsearch:elasticsearch package, versions [7.0.0,7.17.16) [8.0.0,8.11.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGELASTICSEARCH-6125580
- published 14 Dec 2023
- disclosed 12 Dec 2023
- credit Unknown
Introduced: 12 Dec 2023
CVE-2023-49921 Open this link in a new tabHow to fix?
Upgrade org.elasticsearch:elasticsearch to version 7.17.16, 8.11.2 or higher.
Overview
org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to the logging of Watcher search input at the DEBUG log level, which may result in the unintended recording of sensitive information in log files. An attacker can gain access to sensitive data by examining the log files that contain the search query results.
Note:
This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using:
org.elasticsearch.xpack.watcher.input.search
org.elasticsearch.xpack.watcher.input
org.elasticsearch.xpack.watcher or wider, since the loggers are hierarchical.
Workaround
For users that cannot upgrade, if you use Watcher with search input logger set to DEBUG, the logging level can be set to INFO or higher (WARN, ERROR).