CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-31421 – Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
https://notcve.org/view.php?id=CVE-2023-31421
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected. Se descubrió que cuando actuaban como Clientes TLS, Beats, Elastic Agent, APM Server y Fleet Server no verificaban si el certificado del servidor es válido para la dirección IP de destino; sin embargo, aún se realiza la validación de la firma del certificado. Más específicamente, cuando el cliente está configurado para conectarse a una dirección IP (en lugar de un nombre de host), no valida los valores IP SAN del certificado del servidor con esa dirección IP y la validación del certificado falla y, por lo tanto, la conexión no se bloquea como se esperaba. • https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385 https://www.elastic.co/community/security • CWE-295: Improper Certificate Validation •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46667 – Fleet Server Insertion of Sensitive Information into Log File
https://notcve.org/view.php?id=CVE-2023-46667
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch. Se descubrió un problema en Fleet Server en versiones >= v8.10.0 y < v8.10.3 donde los tokens de inscripción del agente se insertan en el archivo de registro del Fleet Server en texto plano. Estos tokens de inscripción podrían permitir que alguien inscriba a un agente en una política de agente y potencialmente usarlo para recuperar otros secretos en la política, incluso para Elasticsearch y servicios de terceros. • https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 https://www.elastic.co/community/security • CWE-532: Insertion of Sensitive Information into Log File •