CVE-2017-8442 Information disclosure in Elasticsearch X-Pack Security

What is CVE-2017-8442?

CVE-2017-8442 is a medium-severity vulnerability in Elasticsearch X-Pack Security, published on 7 Jul 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

Weakness: CWE-200, CWE-402

Which versions are affected by CVE-2017-8442?

It affects 1 product.

Products include Elastic X-Pack.

How do I fix CVE-2017-8442?

No fix has been published for CVE-2017-8442 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-8442 being exploited?

There is no known exploitation of CVE-2017-8442 in the wild and no public exploit code.

Other vulnerabilities in Elasticsearch X-Pack Security

• CVE-2018-3822 Auth bypass in X-Pack Security Critical 9.8
• CVE-2017-8448 Privilege escalation in Elastic X-Pack Alerting High 8.8
• CVE-2017-8438 Privilege escalation in X-Pack Security High 8.8
• CVE-2017-8450 Missing authorization in Elastic X-Pack Security High 7.5
• CVE-2017-8447 Privilege escalation in Elastic X-Pack Security Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9j38-893w-vvh9.