SB2021092812 - IBM Security SOAR update for Elasticsearch

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Preservation of Permissions (CVE-ID: CVE-2021-22137)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to search queries do not properly preserve security permissions when executing certain cross-cluster search queries. A remote user can disclose existence of documents via search functionality, when Document or Field Level Security is used.

2) Security restrictions bypass (CVE-ID: CVE-2021-22135)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. A remote user can perform certain queries to enable the profiler and suggester on index and disclose existence of documents and fields.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-soar-is-using-a-version-of-elasticsearch-that-has-known-vulnerabilities-cve-2021-22137-cve-2021-22135/"
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-soar-is-using-a-version-of-elasticsearch-that-has-known-vulnerabilities-cve-2021-22137-cve-2021-22135/</a></p><p>
• https://www.ibm.com/support/pages/node/6493015</p><p><br></p>