CVE-2023-31141— OpenSearch 安全漏洞

OpenSearch issue with fine-grained access control during extremely rare race conditions

OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

授权机制不正确

OpenSearch 安全漏洞

OpenSearch Project是OpenSearch Project开源的一个社区驱动的、Apache 2.0许可的开放源代码搜索和分析套件。使其易于获取、搜索、可视化和分析数据。 OpenSearch 1.3.10 和 2.7.0版本存在安全漏洞，该漏洞源于访问控制规则（文档级安全性、字段级安全性和字段屏蔽）的实施存在问题，在极端情况下它们未正确应用于查询，竞争条件可能导致不正确的访问授权。

N/A

N/A