CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2020-7021

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

Score
4.9 medium
Published
2021-02-10
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearch6py312-elasticsearch66.8.2_2unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch6</name>
	<range><lt>6.8.14</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elasticsearch versions before 7.10.0 and 6.8.14 have an information
	disclosure issue when audit logging and the emit_request_body option
	is enabled. The Elasticsearch audit log could contain sensitive
	information such as password hashes or authentication tokens. This
	could allow an Elasticsearch administrator to view these details.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2020-7021</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-7021</url>
    </references>
    <dates>
      <discovery>2021-02-10</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>