CVE-2020-7010: Cryptographic Issues in ECK
Summary
CVE-2020-7010: Cryptographic Issues in ECK. Affects github.com/elastic/cloud-on-k8s versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elastic Cloud on Kubernetes (ECK) is a tool that allows users to deploy and manage Elasticsearch clusters on Kubernetes. It is written in Go and provides a convenient way to deploy and manage Elasticsearch in a Kubernetes environment. ECK generates passwords for Elasticsearch using a random number generator. However, versions prior to 1.1.0 use a weak random number generator, which can make it easier for an attacker to brute force the generated credentials if they can determine when the cluster was deployed.
Vulnerability Detail
The vulnerability in ECK arises from the use of a weak random number generator to generate passwords for Elasticsearch. This can allow an attacker to more easily guess or brute force the credentials and gain unauthorized access to the Elasticsearch cluster. The impact of this vulnerability can be significant, as it can lead to unauthorized access to sensitive data stored in the Elasticsearch cluster. It is important to note that the vulnerability is specific to versions prior to 1.1.0 of ECK.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
go get github.com/elastic/cloud-on-k8s@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to ECK version 1.1.0 or later.
Conclusion
In conclusion, the vulnerability in ECK (CVE-2020-7010) arises from the use of a weak random number generator to generate passwords for Elasticsearch. This can allow an attacker to more easily guess or brute force the credentials and gain unauthorized access to the Elasticsearch cluster. To fix this vulnerability, it is recommended to upgrade to ECK version 1.1.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/elastic/cloud-on-k8s →
FAQ
Elastic Cloud on Kubernetes (ECK) is a tool that allows users to deploy and manage Elasticsearch clusters on Kubernetes.
The vulnerability can allow an attacker to guess or brute force the credentials and gain unauthorized access to the Elasticsearch cluster, potentially leading to unauthorized access to sensitive data.
Versions prior to 1.1.0 of ECK are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to ECK version 1.1.0 or later.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to ECK version 1.1.0 or later.
