Hey guys – There is this CVE published for Elasticsearch: Elasticsearch 7.13.4 Security Update - Security Announcements - Discuss the Elastic Stack Has this CVE also been published for OpenSearch? Is there a list of published CVEs for OpenSearch somewhere?

Seems that is sadly not a prio topic - asked about it weeks ago [image] Become a Mitre CNA OpenDistro In order to publish CVE’s for OpenSearch (and OpenDistro) I propose that Amazon/AWS (or any governance organization which is supposed to govern OpenSearch later) become …

At this point in the project, I think there is room for interested parties to step up and investigate. Keep in mind that ES will be dealing with vulnerabilities not only in the formerly Apache2 codebase, but also in their licensed (x-pack) features that are not present in OpenSearch. It isn’t clea…

Let me poke some people (also, sorry @frotsch , I should I have also responded to your thread). The CVE process was brought up in a meeting earlier this week, but I don’t personally have a lot of context.

Right - there are differences between Elasticsearch and OpenSearch. Beyond x-pack, there are different dependency versions, etc. it would require investigation to know of an ES CVE applies to OpenSearch.

@frotsch I’m sorry I missed your earlier comment. :frowning: Thanks to both of you for bringing it up. We’re looking at it now. We also need to better about seeing these quickly, so if you have suggestions, LMK. Thanks, /C (PS I’m heading out of the office, but I will make sure someone stays o…

We have verified that CVE-2021-22145 pertains to code not present in OpenSearch, or any version of Elasticsearch OSS supported by Amazon Elasticsearch Service. There is therefore no impact to OpenSearch or Amazon Elasticsearch Services from this CVE.

OpenSearch CVE Questions

General Feedback

frotsch August 10, 2021, 3:53pm 2

Seems that is sadly not a prio topic - asked about it weeks ago

Topic		Replies	Views
Become a Mitre CNA OpenDistro cve	0	717	April 30, 2021
OpenSearch and Updated nss fix CVE-2021-43527 OpenDistro releases , cve	10	1204	December 16, 2021
CVE-2022-21449 - Is OpenSearch affected? Security discuss , cve , security-issue	1	715	April 26, 2022
Vulnerability in High level client fixed in Elasticsearch 7.11.0, when in OpenSearch? OpenSearch Client Libraries opensearch-java	9	1837	August 13, 2021
Logstash OSS with OpenSearch Output Plugin Log4j vulnerable OpenDistro cve , security-issue	7	1941	December 16, 2021

OpenSearch CVE Questions

Related topics