CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2021-22135

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.

Score
5.3 medium
Published
2021-05-13
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearch6py312-elasticsearch66.8.2_2unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch6</name>
	<range><lt>6.8.15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Elasticsearch versions before 7.11.2 and 6.8.15 contain a document
	disclosure flaw was found in the Elasticsearch suggester and profile
	API when Document and Field Level Security are enabled. The suggester
	and profile API are normally disabled for an index when document level
	security is enabled on the index. Certain queries are able to enable
	the profiler and suggester which could lead to disclosing the
	existence of documents and fields the attacker should not be able to
	view.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-22135</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-22135</url>
    </references>
    <dates>
      <discovery>2021-05-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>