PT-2020-19335 · Elastic · Cloud On Kubernetes

Published 2020-06-03 · Updated 2024-02-10 · CVE-2020-7010

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0

Description The issue concerns a weak random number generator used to generate passwords in Elastic Cloud on Kubernetes (ECK). This weakness can be exploited if an attacker determines when the Elastic Stack cluster was deployed, potentially allowing them to brute force the Elasticsearch credentials more easily.

Recommendations For Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider regenerating passwords using a secure random number generator until a patch is applied. Restrict access to the Elasticsearch credentials to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-335

Related Identifiers

CVE-2020-7010

GHSA-VFP4-XX6M-7VF6

Affected Products

Cloud On Kubernetes

References · 8

• https://elastic.co/community/security · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7010 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7010 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vfp4-xx6m-7vf6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7010 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-7010 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7010 · Vendor Advisory
• https://t.me/cvenotify/4155 · Telegram Post