CVE-2023-31141

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-31141

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31141.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-31141

Aliases

GHSA-g8xc-6mf7-h28h

Downstream

UBUNTU-CVE-2023-31141

Published

2023-05-08T20:33:58.601Z

Modified

2026-08-12T13:34:22.161491Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

OpenSearch issue with fine-grained access control during extremely rare race conditions

Details

OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31141.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/opensearch-project/anomaly-detection

Affected ranges

Type

GIT

Repo

https://github.com/opensearch-project/anomaly-detection

Events

Introduced

Fixed

ecb2f8c157edf73ef655fc5c3f6791cc012db992

Introduced

ce81e915882980d819780c83d8f767ca295fbbcb

Fixed

0a48da9e1a0cd70c64cc2da228674baaf377c89e

Database specific

Show details

{
    "cpe": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.10"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.7.0"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/opensearch-project/opensearch

Events

Introduced

Fixed

b2150b9f6f6c8a15059ef415d3e24bdedd3e253c

Introduced

bae3b4e4178c20ac24fece8e82099abe3b2630d0

Fixed

b7a6e09e492b1e965d827525f7863b366ef0e304

Database specific

Show details

{
    "cpe": "cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.10"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.7.0"
        }
    ],
    "source": "CPE_RANGE"
}

Type

GIT

Repo

https://github.com/opensearch-project/security

Events

Introduced

cd6df074a44b5ebc1c22940e6d2d149f162f475c

Fixed

87c8e468f4c47bea0a140b52e39197aef4ff45ba

Introduced

5e6457703a6609c556f357aafdb116f4a2f30c05

Fixed

54aee2d1f276181c15f4b458dbe926f33a9d0d83

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.3.10"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.7.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other

(None)

1.*

1.0.0-alpha1

1.0.0-alpha2

1.0.0-beta1

1.0.0.0-beta1

1.0.0.0-rc1

1.3.0

1.3.0.0

1.3.1

1.3.1.0

1.3.2

1.3.2.0

1.3.3

1.3.3.0

1.3.4

1.3.4.0

1.3.5

1.3.5.0

1.3.6

1.3.6.0

1.3.7

1.3.7.0

1.3.8

1.3.8.0

1.3.9

1.3.9.0

v1.*

v1.10.0.0

v1.10.1.0

v1.11.0.0

v1.12.0.0

v1.13.0.0

v1.7.0.0

v1.8.0.0

v1.9.0.0

Database specific

vanir_signatures_modified

"2026-08-12T13:34:22Z"

vanir_signatures

[
    {
        "id": "CVE-2023-31141-1c641e4a",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 502.0,
            "function_hash": "5756378763277159257205971695528604029"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testCreateSearchableSnapshotWithChunks",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-1daf3c4c",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "129345768623793259266581369174869673798",
                "89999102824515399516675583476455393301",
                "72693493658590992470198837322419552840",
                "243916979723486310843887582020561225069",
                "264622679832315348253592428824051832638",
                "320350971627914456427545839178965862598",
                "71601822759165976677111355562125051195",
                "143138293465087258069458622803455587748",
                "93613827757483070939253005060992076929",
                "22572647976082339780758341726535533677"
            ]
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "file": "server/src/main/java/org/opensearch/snapshots/RestoreService.java"
        }
    },
    {
        "id": "CVE-2023-31141-221c0f0a",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "5537734376540317134902033736443228727",
                "329061080066321160016350746737862042012",
                "321586057311454449027382334726888387438",
                "60431921887807127021006404746410778737",
                "68640858005384046770946259356730527459",
                "40781488850710964261369272336597166709",
                "41357547087551300326682916144572924559",
                "309639019977927704009612861706310383626",
                "280738283385407749760931075581949639467",
                "152537579802095273639967685204083527978",
                "167553843332366943677595486464680391802",
                "240454360840683495484225810597223627830",
                "147942876082226720442454683561508111285",
                "93616384115284419588438714978910444113",
                "91764857755843068008643274053595539100",
                "218101864245954947596865560572353656423",
                "257821147292341696170875607101941147170",
                "66634359107753057006622950191561567980",
                "221091191949559080450444570409169819905",
                "23850208137776968404468957359716455783",
                "91971071479757684705057157100456396543",
                "230201864400808686334228685923381961766",
                "293625797013541445149649828980081191242",
                "294735000743361363074902539345938993082",
                "4094911234083469120152350925538244550",
                "77323350577058743959528422114375846964",
                "171756876794521415889230874306627043881",
                "132321416409465875965323829784566876576",
                "21460688664191757001884477957438508236",
                "334004439530129367407968458352921565093",
                "41799671065480603749759733104417315066",
                "66944213276135418363024191416454001075",
                "76996323551308488512483210748480195085",
                "79331908283117865137779441762894402425",
                "231944283076385786883703402214755605281",
                "4094911234083469120152350925538244550",
                "99396752511777204876084915527398074008",
                "84034710944016524823634025217551009923",
                "226478331752963361844042885260490524914",
                "91971071479757684705057157100456396543",
                "230201864400808686334228685923381961766",
                "328377635328191794676393202224008751541",
                "67145472847313052181625230441259678936",
                "120402068203863197252611586589897840598",
                "51423638216787440122085314918556572278",
                "142782825516785082551407033498795425086",
                "39769244533898056062149531758237380205",
                "66634359107753057006622950191561567980",
                "308320966324857995200026584324466920",
                "13027510379768748075490516674910945577",
                "329223139793143768867870110256350020832"
            ]
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-3a0181a7",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 769.0,
            "function_hash": "241655463586225443691616481490424290883"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "addSnapshotToIndexSettings",
            "file": "server/src/main/java/org/opensearch/snapshots/RestoreService.java"
        }
    },
    {
        "id": "CVE-2023-31141-5634756b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 491.0,
            "function_hash": "252123002699142891325222165294949048694"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testPruneFileCacheOnIndexDeletion",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-59fdd779",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 766.0,
            "function_hash": "191065210629172186704534320634584844054"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testCreateSearchableSnapshot",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-83b394da",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 362.0,
            "function_hash": "338186898508621988859801994332743189126"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "createIndexWithDocsAndEnsureGreen",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-8f22830e",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 996.0,
            "function_hash": "241632196872913397165412081873104285228"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testSearchableSnapshotAllocationForFailoverAndRecovery",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-a96c93c2",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 470.0,
            "function_hash": "233539456361273365804340278249661131593"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testSearchableSnapshotAllocationForLocalAndRemoteShardsOnSameNode",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-ae127692",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 689.0,
            "function_hash": "223579872837145656522378004559238852615"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testCacheIndexFilesClearedOnDelete",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-e88a4cc6",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 696.0,
            "function_hash": "231184595991442635606770355241252897189"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testSearchableSnapshotIndexIsReadOnly",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-f67763df",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1238.0,
            "function_hash": "340169360497078216629455203831094308234"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testFileCacheRestore",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    },
    {
        "id": "CVE-2023-31141-f782346e",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 471.0,
            "function_hash": "133825621670563839916428222488976856314"
        },
        "source": "https://github.com/opensearch-project/opensearch/commit/b7a6e09e492b1e965d827525f7863b366ef0e304",
        "target": {
            "function": "testUpdateIndexSettings",
            "file": "server/src/internalClusterTest/java/org/opensearch/snapshots/SearchableSnapshotIT.java"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31141.json"