Bug 1364394 (CVE-2016-1000219)

Summary:	CVE-2016-1000219 kibana: Session hijack via stealing cookies and auth headers from log ESA-2016-04
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aortega, apevec, ayoung, bleanhar, ccoleman, chrisw, cvsbot-xmlrpc, dedgar, dmcphers, jgoulding, jialiu, jkeck, joelsmith, jokerman, jschluet, kbasil, kseifried, lhh, lmeyer, lpeer, markmc, mbracho, mmagr, mmccomas, mrunge, rbryant, sclewis, slong, tdawson, tdecacqu
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kibana 4.5.4, kibana 4.1.11	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Kibana's logging functionality. If custom logging output was configured in Kibana, private user data could be written to the Kibana log files. A system attacker could use this data to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-21 01:18:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1370891, 1370892, 1372521, 1372522, 1372523, 1372524
Bug Blocks:	1364395

Description Adam Mariš 2016-08-05 09:19:26 UTC

It was reported that when a custom output is configured for logging in versions of Kibana before 4.5.4 and 4.1.11, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.

External Reference:

https://www.elastic.co/community/security

Comment 4 errata-xmlrpc 2016-09-08 16:23:39 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.2
  Red Hat OpenShift Enterprise 3.1

Via RHSA-2016:1836 https://access.redhat.com/errata/RHSA-2016:1836