CVE-2023-25806

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-25806
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25806.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25806
Aliases
Published
2023-03-02T03:04:26.889Z
Modified
2026-04-10T04:56:07.009439Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Time discrepancy in authentication responses in OpenSearch
Details

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-208"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25806.json"
}
References

Affected packages

Git / github.com/opensearch-project/security

Affected ranges

Type
GIT
Repo
https://github.com/opensearch-project/security
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0004aba21d56ff62ea2f445758b51fd21f431e63
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/opensearch-project/security
Events
Introduced
5e6457703a6609c556f357aafdb116f4a2f30c05
Fixed
766cf3f713fb7621faa8546ca5c2f37f5a847009
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.6.0"
        }
    ]
}

Affected versions

1.*
1.0.0.0
1.1.0.0
1.3.0.0
1.3.1.0
1.3.2.0
1.3.3.0
1.3.4.0
1.3.5.0
1.3.6.0
1.3.7.0
1.3.8.0
v0.*
v0.7.0.0
v0.7.0.1
v0.8.0.0
v0.9.0.0
v1.*
v1.0.0.0
v1.0.0.0-beta1
v1.0.0.0-beta1-rc1
v1.0.0.0-beta1-rc2
v1.0.0.0-beta1-rc3
v1.0.0.0-rc1
v1.0.1.0-OS-rc1
v1.1.0.0
v1.10.0.0-rc1
v1.10.1.0
v1.10.1.0-rc1
v1.10.1.0-rc2
v1.11.0.0
v1.11.0.0-rc1
v1.12.0.0
v1.12.0.0-rc
v1.13.0.0
v1.13.0.0-rc1
v1.13.0.0-rc2
v1.13.0.0-rc3
v1.13.0.0-rc4
v1.13.1.0
v1.13.1.0-rc1
v1.13.1.0-rc2
v1.3.0.0
v1.5.0.0
v1.5.0.1
v1.6.0.0
v1.7.0.0
v1.8.0.0
v1.9.0.0
v1.9.0.0-rc1
v1.9.0.0-rc2
v1.9.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25806.json"