Weak Random Number Generator in Elastic Cloud on Kubernetes by Elastic
CVE-2020-7010

7.5HIGH

Key Information:

Vendor
Elastic
Status
Elastic Cloud On Kubernetes
Vendor
CVE Published:
3 June 2020

Summary

Prior to version 1.1.0, Elastic Cloud on Kubernetes (ECK) employs a weak random number generator for password creation. This flaw can be exploited by an attacker who knows when the Elastic Stack cluster was deployed, significantly increasing the likelihood of successfully brute-forcing the Elasticsearch credentials generated during the deployment process.

Affected Version(s)

Elastic Cloud on Kubernetes before 1.1.0

References

https://www.elastic.co/community/security/
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.