CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2020-7019

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

Score
6.5 medium
Published
2020-08-18
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearch6py312-elasticsearch66.8.2_2unaddressedsunpoet@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch6</name>
	<range><lt>6.8.12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was
	found when running a scrolling search with Field Level Security. If a
	user runs the same query another more privileged user recently ran,
	the scrolling search can leak fields that should be hidden. This could
	result in an attacker gaining additional permissions against a
	restricted index.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2020-7019</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-7019</url>
    </references>
    <dates>
      <discovery>2020-08-18</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>