There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to
    requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers
    intended for another request if the same username is being authenticated concurrently; when used with run
    as, this can result in the request running as the incorrect user. This could allow a user to access
    information that they should not have access to. (CVE-2018-17244)

Elasticsearch Security 6.4.0 至 6.4.2 版，在使用 Active Directory、LDAP、Native 或 File 領域將要求標頭套用至要求的方式中存在一個錯誤。如果同時驗證相同的使用者名稱，則要求可能收到原本針對其他要求的標頭；搭配執行身分使用時，這可導致要求以錯誤的使用者身分執行。這可允許使用者存取他們不應具有存取權的資訊。

Elasticsearch Security 6.4.0 到 6.4.2 版本在使用 Active Directory、LDAP、Native 或 File 域时，为请求应用请求标头的方式中包含错误。如果同时对同一用户名进行身份验证，一个请求可能收到用于另一请求的标头，当如此运行使用时，可导致请求作为错误用户运行。此问题可允许用户访问原本无权访问的信息。

Elasticsearch Securityバージョン6.4.0～6.4.2では、Active Directory、LDAP、ネイティブ、ファイル領域を使用しているとき、リクエストヘッダーをリクエストに適用する方法にエラーが含まれています。同じユーザー名が同時に認証されている場合、リクエストは別のリクエストを意図したヘッダーを受け取ることがあり、run asで使用するとき、リクエストが誤ったユーザーとして実行される可能性があります。このため、ユーザーがアクセス権を持たない情報にアクセスする可能性があります。

An update of the elasticsearch package has been released.

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
419470	SCA: security update for org.elasticsearch:elasticsearch (GHSA-vpqm-88c4-x4cv)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
419470	SCA: security update for org.elasticsearch:elasticsearch (GHSA-vpqm-88c4-x4cv)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium
118799	Elasticsearch ESA-2018-16	Nessus	CGI abuses	2018/11/7	2019/11/1	medium
118799	Elasticsearch ESA-2018-16	Nessus	CGI abuses	2018/11/7	2019/11/1	medium
118799	Elasticsearch ESA-2018-16	Nessus	CGI abuses	2018/11/7	2019/11/1	medium
122906	Photon OS 2.0: Elasticsearch PHSA-2019-2.0-0132	Nessus	PhotonOS Local Security Checks	2019/3/18	2024/7/23	medium
133297	Photon OS 1.0: Elasticsearch PHSA-2019-1.0-0209	Nessus	PhotonOS Local Security Checks	2020/1/28	2020/1/29	medium
118799	Elasticsearch ESA-2018-16	Nessus	CGI abuses	2018/11/7	2019/11/1	medium
202905	Photon OS 3.0: Elasticsearch PHSA-2019-3.0-0002	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/24	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium