PT-2023-20318 · Opensearch+1 · Opensearch Security+1

Cehenkle · Published 2023-03-01 · Updated 2025-04-03 · CVE-2023-25806

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch Security versions prior to 1.3.9 OpenSearch Security versions prior to 2.6.0

Description OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication, and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs.

Recommendations For versions prior to 1.3.9, update to version 1.3.9 or later. For versions prior to 2.6.0, update to version 2.6.0 or later. As there are no workarounds, applying the patch is the recommended course of action.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

BDU:2025-04194

CVE-2023-25806

GHSA-C6WG-CM5X-RQVJ

Affected Products

Opensearch Security

Red Os

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25806.json · Exploit
• https://github.com/opensearch-project/security/security/advisories/GHSA-c6wg-cm5x-rqvj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25806 · Security Note
• https://bdu.fstec.ru/vul/2025-04194 · Security Note
• https://osv.dev/vulnerability/GHSA-c6wg-cm5x-rqvj · Vendor Advisory
• https://github.com/opensearch-project/security · Note
• https://github.com/opensearch-project/security/pull/2472 · Note
• https://t.me/cibsecurity/59312 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/45931 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25806 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-opensearch-cve-2023-25806 · Note