Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.
References:MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZmcDQteHg2bS03dmY2
Cryptographic Issues in ECK
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
|
go:github.com/elastic/cloud-on-k8s
PURL:
pkg:go/github.com%2Felastic%2Fcloud-on-k8s
|
< 1.1.0 | 1.1.0 | |
Affected Version RangesAll affected versionsv0.0.0-20220105094828-721cccfd905f, v0.0.0-20220627132447-8df5d6ccb7d9 All unaffected versions |
|||