Bug 1849046 (CVE-2020-7012)

Summary:	CVE-2020-7012 kibana: Prototype pollution in the Upgrade Assistant could result in arbitrary code execution (ESA-2020-05)
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aos-bugs, bmontgom, eparis, jburrell, jcantril, jokerman, nstielau, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kibana 7.6.3, kibana 6.8.9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-25 03:09:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1849050

Description Michael Kaplan 2020-06-19 14:11:31 UTC

Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

References:

https://www.elastic.co/community/security/

Comment 1 Joshua Padman 2020-06-25 03:09:15 UTC

Statement:

The vulnerable functionality was introduced in Kibana 6.7, we ship Kibana 5.6 and it has not been back ported. Additionally, it is a component of the X-Pack, paid additions for Kibana.

Comment 2 Joshua Padman 2020-06-25 03:32:47 UTC

External References:

https://discuss.elastic.co/t/elastic-stack-6-8-9-and-7-7-0-security-update/235571