GitHub Advisoryadvisory · Go

GHSA-f6cj-4h3g-hwq4 APM Server vulnerable to Insertion of Sensitive Information into Log File

MEDIUM Published 2024-08-03 Modified 2024-08-07 Official page ↗
Aliases
CVE-2024-37286
Ecosystem
Go
Packages
github.com/elastic/apm-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-08-05

Affected packages

• Go github.com/elastic/apm-server: < 8.14.0 → fixed in 8.14.0

Description

APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.

Related

Alias · CVE (1)

  • CVE-2024-37286 APM server logs contain document body from a partially failed bulk index request. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References