Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch

2022-05-2416:51:49

Google

osv.dev

0.002 Low

EPSS

Percentile

53.8%

JSON

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.

CPENameOperatorVersion
org.elasticsearch:elasticsearcheq6.7.2
org.elasticsearch:elasticsearcheq2.0.0-rc1
org.elasticsearch:elasticsearcheq0.90.9
org.elasticsearch:elasticsearcheq1.0.0
org.elasticsearch:elasticsearcheq2.4.6
org.elasticsearch:elasticsearcheq6.0.0-beta2
org.elasticsearch:elasticsearcheq0.90.0
org.elasticsearch:elasticsearcheq5.3.1
org.elasticsearch:elasticsearcheq5.0.0-beta1
org.elasticsearch:elasticsearcheq1.0.0.RC2

Name	Operator	Version
org.elasticsearch:elasticsearch	eq	6.7.2
org.elasticsearch:elasticsearch	eq	2.0.0-rc1
org.elasticsearch:elasticsearch	eq	0.90.9
org.elasticsearch:elasticsearch	eq	1.0.0
org.elasticsearch:elasticsearch	eq	2.4.6
org.elasticsearch:elasticsearch	eq	6.0.0-beta2
org.elasticsearch:elasticsearch	eq	0.90.0
org.elasticsearch:elasticsearch	eq	5.3.1
org.elasticsearch:elasticsearch	eq	5.0.0-beta1
org.elasticsearch:elasticsearch	eq	1.0.0.RC2