Bug 1696030 (CVE-2019-7609)
| Summary: | CVE-2019-7609 kibana: Arbitrary code execution flaw in the Timelion visualizer | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | ahardin, aos-bugs, bleanhar, bmontgom, ccoleman, dbecker, dedgar, eparis, jburrell, jcantril, jgoulding, jjoyce, jokerman, jschluet, kbasil, lhh, lpeer, mburns, mchappel, mmagr, nstielau, sclewis, slinaber, sponnaga |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kibana 5.6.15, kibana 6.6.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An arbitrary code execution flaw was found in the Timelion visualizer in Kibana versions before 5.6.15 and 6.6.1. This flaw allows an attacker with access to the Timelion application to send a request that attempts to execute javascript code. This could lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-09-30 18:45:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1732058, 1732059, 1747796 | ||
| Bug Blocks: | 1696031 | ||
|
Description
Pedro Sampaio
2019-04-04 03:42:16 UTC
No versions of Red Hat OpenStack Platform Operational Tools are affected by this flaw. OpenShift Container Platform 3.11 and 4.1 contain 5.6.13: $ docker run -ti registry.redhat.io/openshift3/ose-logging-kibana5:v3.11 rpm -q kibana kibana-5.6.13-1.el7.x86_64 $ docker run -ti registry.redhat.io/openshift4/ose-logging-kibana5:4.1 rpm -q kibana kibana-5.6.13-1.el7.x86_64 (Note openshift3 vs openshift4 in repo; note v3.11 vs 4.1 in tag) OpenShift Container Platform 3.10 and earlier pre-date the reported kibana 5 issue. $ docker run -ti registry.redhat.io/openshift3/ose-logging-kibana:v3.10 rpm -q kibana kibana-4.6.4-4.el7.x86_64 docker run -ti registry.redhat.io/openshift3/ose-logging-kibana:v3.9 rpm -q kibana kibana-4.6.4-4.el7.x86_64 External References: https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 Based on further analysis, this flaw warrants an "Important" severity, not "Moderate". Notes to explain differences in CVSS scoring have also been added. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2860 https://access.redhat.com/errata/RHSA-2019:2860 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-7609 |