GitHub Advisoryadvisory · Go

GHSA-vfp4-xx6m-7vf6 Cryptographic Issues in ECK

HIGH Published 2022-02-15 Modified 2024-02-12 Official page ↗
Aliases
CVE-2020-7010
Ecosystem
Go
Packages
github.com/elastic/cloud-on-k8s
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-335
Reviewed
2021-05-13

Affected packages

• Go github.com/elastic/cloud-on-k8s: < 1.1.0 → fixed in 1.1.0

Description

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

Related

Alias · CVE (1)

  • CVE-2020-7010 Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. vulnerability

Weakness · CWE (1)

  • CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) weakness

References