CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2021-22137

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Score
5.3 medium
Published
2021-05-13
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearch6py312-elasticsearch66.8.2_2unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch6</name>
	<range><lt>6.8.15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In Elasticsearch versions before 7.11.2 and 6.8.15 a document
	disclosure flaw was found when Document or Field Level Security is
	used. Search queries do not properly preserve security permissions
	when executing certain cross-cluster search queries. This could result
	in the search disclosing the existence of documents the attacker
	should not be able to view. This could result in an attacker gaining
	additional insight into potentially sensitive indices.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-22137</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-22137</url>
    </references>
    <dates>
      <discovery>2021-05-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>