Elastic Docker images trust compromised certificate authorities, allowing interception of TLS connections
Encrypted traffic of Elastic server programs can be spied on.
Summary
The operating system certificate bundle in Elastic Docker images includes root authorities that signed intermediate authorities with compromised keys. An attacker positioned between the product and a remote server can intercept or modify TLS-protected traffic.
Affected when
- Elastic products run from Docker images
- TLS connections that use the operating system certificate bundle
- Attacker in a network position between the product and the remote party
What to do
No fixed version is named in the sources. Check that the product runs a version newer than 8.19.23, 9.4.8 or 9.5.5 for its release line, and read the Elastic advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen