CVE-2022-41917: Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a response containing the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with read permissions allowed in the Java Security Manager policy configuration. OpenSearch version 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
Other sources
OpenSearch Project OpenSearch could allow a remote authenticated attacker to obtain sensitive information, caused by an incorrect error handling in the REST API. By sending a specially-crafted request, an attacker could exploit this vulnerability to read partial file information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-41917?
CVE-2022-41917 is a vulnerability in OpenSearch that allows certain specially crafted queries to return a response.
What is the severity of CVE-2022-41917?
CVE-2022-41917 has a severity rating of medium with a CVSS score of 4.3.
How does CVE-2022-41917 affect OpenSearch?
CVE-2022-41917 affects OpenSearch versions 1.0.0 to 1.3.7 and 2.0.0 to 2.4.0.
How can I fix CVE-2022-41917?
To fix CVE-2022-41917, it is recommended to upgrade to a version of OpenSearch that includes the fix.
Where can I find more information about CVE-2022-41917?
More information about CVE-2022-41917 can be found in the OpenSearch GitHub repository and the OpenSearch security advisories.