Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-8442: Elasticsearch X-Pack may expose SSL passwords via _nodes API

CVE-2017-8442 · published 9 years ago

Summary

Versions 5.0.0 through 5.4.3 of Elasticsearch X-Pack Security can reveal configuration details, including file locations and passphrases for SSL keys, when the _nodes API is used. An authenticated user could see this sensitive information, potentially compromising secure communications. Update to a later version or disable the _nodes API for untrusted users to protect the data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
elastic	x-pack	>= 5.0.0, <= 5.4.3 `cpe:2.3:a:elastic:x-pack::::::::`

Original advisory text

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

References

https://www.elastic.co/community/security Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-402Transmission of Private Resources into a New Sphere ('Resource Leak')

CWE-200Information Exposure

Timeline

Published7 Jul 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-8442 · NVD

Track software like this

Free during beta