PatchTheCVEsearch guard vulnerabilities and fixes
Recent CVEs affecting search guard, with upgrade or downgrade steps. 10 tracked.
Also searched as: searchguard.
search guard has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2019-08-23. Highest priority: CVE-2019-13419 (score 46/100).
- CVE-2019-13423 HIGH 8.8 UPGRADE Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kiba
- CVE-2019-13422 MEDIUM 6.1 UPGRADE Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redir
- CVE-2019-13421 MEDIUM 4.9 UPGRADE Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password
- CVE-2019-13420 MEDIUM 5.9 UPGRADE Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.
- CVE-2019-13419 HIGH 7.5 UPGRADE Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields we
- CVE-2019-13418 HIGH 7.5 UPGRADE Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anon
- CVE-2019-13417 MEDIUM 5.3 UPGRADE Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not value
- CVE-2019-13416 MEDIUM 6.5 UPGRADE Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated user
- CVE-2019-13415 MEDIUM 6.5 UPGRADE Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated user
- CVE-2018-20698 MEDIUM 6.1 UPGRADE The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the log
FAQ
How do I fix search guard vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is search guard being exploited right now?
None of the tracked search guard CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which search guard CVE should I patch first?
CVE-2019-13419 currently ranks highest (46/100): Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields we.