GHSA-vfp4-xx6m-7vf6

ghsaUSosv

Cryptographic Issues in ECK

view advisory published 2022-02-15Licence: CC-BY-4.0

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-7010US	high7.5	1.44% (73rd)	—	2020-06-03
Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stac…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2020-7010ADVISORY
https://www.elastic.co/community/securityWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan