CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Score
3.1 low
Published
2020-10-22
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearch6py312-elasticsearch66.8.2_2unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch6</name>
	<range><lt>6.8.13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elasticsearch versions before 6.8.13 and 7.9.2 contain a document
	disclosure flaw when Document or Field Level Security is used. Search
	queries do not properly preserve security permissions when executing
	certain complex queries. This could result in the search disclosing
	the existence of documents the attacker should not be able to view.
	This could result in an attacker gaining additional insight into
	potentially sensitive indices.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2020-7020</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-7020</url>
    </references>
    <dates>
      <discovery>2020-10-22</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>