CVE-2023-25806
Medium
Description
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.
SeverityMedium
CVSS5.3
Exploit probability—
ProductAmazon Opensearch
PublishedMar 2, 2023
First seenMar 2, 2023
Weakness typeCWE-208CWE-208
How to fix
Update
- amazon opensearch1.3.9, 2.6.0 or later
- amazon opensearch_security1.3.9, 2.6.0 or later
- org.opensearch.plugin:opensearch-security1.3.9, 2.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amazon opensearch | v < 1.3.9, 2.0.0 ≤ v < 2.6.0 | 1.3.9, 2.6.0 |
| amazon opensearch_security | v < 1.3.9, 2.0.0 ≤ v < 2.6.0 | 1.3.9, 2.6.0 |
| org.opensearch.plugin:opensearch-securityMaven | v < 1.3.9, 2.0.0 ≤ v < 2.6.0 | 1.3.9, 2.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.