GitHub Advisoryadvisory · Maven

GHSA-c6wg-cm5x-rqvj OpenSearch has time discrepancy in authentication responses

MEDIUM Published 2023-03-07 Modified 2023-03-07 Official page ↗
Aliases
CVE-2023-25806
Ecosystem
Maven
Packages
org.opensearch.plugin:opensearch-security
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2023-03-07

Affected packages

• Maven org.opensearch.plugin:opensearch-security: < 1.3.9 → fixed in 1.3.9 • Maven org.opensearch.plugin:opensearch-security: >= 2.0.0, < 2.6.0 → fixed in 2.6.0

Description

Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches OpenSearch 1.3.9 and 2.6.0 Workarounds None. References If you have any questions or comments about this advisory, please contact AWS/Amazon Security using our issue reporting page [1] or directly via email [2]. Please do not create a public GitHub issue. [1] AWS Security issue reporting page: https://aws.amazon.com/security/vulnerability-reporting/ [2] AWS Security email: [email protected]

Related

Alias · CVE (1)

  • CVE-2023-25806 OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References