PatchTheCVEsearch-guard vulnerabilities
Recent CVEs affecting search-guard products. 10 tracked.
search-guard has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2019-08-23. Highest priority: CVE-2019-13419 (score 46/100).
- CVE-2019-13423 HIGH 8.8 UPGRADE Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kiba
- CVE-2019-13422 MEDIUM 6.1 UPGRADE Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redir
- CVE-2019-13421 MEDIUM 4.9 UPGRADE Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password
- CVE-2019-13420 MEDIUM 5.9 UPGRADE Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.
- CVE-2019-13419 HIGH 7.5 UPGRADE Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields we
- CVE-2019-13418 HIGH 7.5 UPGRADE Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anon
- CVE-2019-13417 MEDIUM 5.3 UPGRADE Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not value
- CVE-2019-13416 MEDIUM 6.5 UPGRADE Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated user
- CVE-2019-13415 MEDIUM 6.5 UPGRADE Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated user
- CVE-2018-20698 MEDIUM 6.1 UPGRADE The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the log
FAQ
How do I fix search-guard vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is search-guard being exploited right now?
None of the tracked search-guard CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which search-guard CVE should I patch first?
CVE-2019-13419 currently ranks highest (46/100): Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields we.