A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Elasticsearch | Elastic | 7.16.0 (including) | 7.17.1 (excluding) |
| Elasticsearch | Ubuntu | esm-apps/xenial | * |
| Elasticsearch | Ubuntu | trusty | * |
| Elasticsearch | Ubuntu | xenial | * |