# Vulnerabilities by severity issues in OpenSearch/Dashboard 2.10.0 Image Version

**URL:** <https://forum.opensearch.org/t/vulnerabilities-by-severity-issues-in-opensearch-dashboard-2-10-0-image-version/16287>\
**Category:** Security\
**Tags:** releases, install, security-issue\
**Created:** [October 16, 2023, 11:44am UTC](https://forum.opensearch.org/t/vulnerabilities-by-severity-issues-in-opensearch-dashboard-2-10-0-image-version/16287 "2023-10-16T11:44:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhanu1](https://avatars.discourse-cdn.com/v4/letter/b/9de0a6/32.png) [@bhanu1](https://forum.opensearch.org/u/bhanu1)\
**Post date:** [October 16, 2023, 11:44am UTC](https://forum.opensearch.org/t/vulnerabilities-by-severity-issues-in-opensearch-dashboard-2-10-0-image-version/16287/1 "2023-10-16T11:44:51Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
Opensource Opensearch/Dashboard {{ 2.10.0}}

**Describe the issue** :  
I am scaning the Opensearch and Dashboard Images in our envirnamnet, in this time I got Vulnerabilities by severity errors.

**Configuration** :  
Image procurement Jenkins Jobs failed due Vulnerabilities.

**Relevant Logs or Screenshots** :  
Opensearch Vulnerabilities screenshot

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/e/e6d42dd41b89f681ad5d4378306be6ac0d56bfd1.png)  
Dashboard Vulnerabilities screenshot  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/8/83cb44320d66d33f14fd62143efa0af1caea88a2.png)

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [October 16, 2023, 3:12pm UTC](https://forum.opensearch.org/t/vulnerabilities-by-severity-issues-in-opensearch-dashboard-2-10-0-image-version/16287/2 "2023-10-16T15:12:03Z")

</div>

Hello @bhanu1 - thank you for letting us know.  
(cc @scrawfor @peternied @davelago )

---

<div class="post-metadata">

**Author:** ![wbeckler](https://avatars.discourse-cdn.com/v4/letter/w/9d8465/32.png) [@wbeckler](https://forum.opensearch.org/u/wbeckler)\
**Post date:** [October 18, 2023, 7:16am UTC](https://forum.opensearch.org/t/vulnerabilities-by-severity-issues-in-opensearch-dashboard-2-10-0-image-version/16287/3 "2023-10-18T07:16:19Z")

</div>

Hello,

Thank you for your message about the CVEs reported in OpenSearch/OpenSearch Dashboards version 2.10. After a thorough review we have determined this version is not impacted by the following CVEs:

ALAS-2023-2287  
ALAS-2023-2271  
CVE-2020-36604

In addition, the following CVEs have been addressed by including updated versions of the relevant libraries and any necessary fixes in the 2.11 release, which was released October 16:

CVE-2023-43642  
CVE-2023-4586  
CVE-2023-42503  
CVE-2023-32002  
CVE-2023-32006  
CVE-2023-32559  
ALAS-2023-2287  
ALAS-2023-2271  
GHSA-xpw8-rcwv-8f8p

Finally, the following CVE will be addressed by including updated versions of the relevant libraries and any necessary fixes in the upcoming 2.12 release, with a tentative target release date of January 23, 2024:

CVE-2022-45146 ([[Manual Backport 2.x] Bump org.bouncycastle:bc-fips from 1.0.2.3 to 1.0.2.4 in /distribution/tools/plugin-cli (#10297) by noCharger · Pull Request #10672 · opensearch-project/OpenSearch · GitHub](https://github.com/opensearch-project/OpenSearch/pull/10672))