Bug 1927480 (CVE-2020-7021)

Summary:	CVE-2020-7021 elasticsearch: Information disclosure via audit logging with emit_request_body option enabled
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, apevec, bibryam, bmontgom, chazlett, dbruno, dfreiber, dhanak, dramseur, drieden, drosa, drow, eparis, etirelli, ganandan, ggaughan, gmalinko, hbraun, ibek, janstey, jburrell, jcantril, jhunter, jjoyce, jochrist, jokerman, jrokos, jschluet, jstastny, jwon, kmitts, krathod, kverlaen, lhh, lpeer, mburns, mgala, mjudeiki, mnovotny, nstielau, pantinor, pdelbell, piotr1212, pjindal, rrajasek, rstepani, rsynek, sausingh, sclewis, sdaley, slinaber, sponnaga, steve.traylen, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	elasticsearch 7.10.0, elasticsearch 6.8.14	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 08:45:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1927481, 1927482, 1927483
Bug Blocks:	1927488

Description Pedro Sampaio 2021-02-10 20:23:22 UTC

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

References:

https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915

Comment 1 Pedro Sampaio 2021-02-10 20:24:34 UTC

Created python-elasticsearch tracking bugs for this issue:

Affects: epel-all [bug 1927482]
Affects: fedora-all [bug 1927483]
Affects: openstack-rdo [bug 1927481]

Comment 3 Przemyslaw Roguski 2021-02-15 18:08:33 UTC

The audit logging requires xpack security audit plugin and GOLD/PLATINUM/ENTERPRISE subscription. 
So the vulnerable component is not available in the opensource version.

Comment 4 juneau 2021-02-15 20:36:15 UTC

Setting Hosting OCP "notaffected" per
- http://localhost:5600/static/#/flaw/1927480#comment3
- http://localhost:5600/static/#/task/1927488?tab=product_subtasks_cloudplatform#comment1