Sql
Monthly
Unsafe Java deserialization in the OpenSearch SQL plugin allows a remote user holding only basic read/search permissions to run arbitrary code on the node by sending a crafted `cursor` parameter to the `plugins/sql` endpoint. The flaw affects the 2.x line from 2.8.0.0 up to (but not including) 2.19.6.0 and the 3.x line from 3.0.0 up to 3.7.0.0, and it is fixed in releases 2.19.6.0 and 3.7.0.0; the plugin ships enabled by default in OpenSearch distributions, so no unusual configuration is needed to reach the vulnerable path. No public exploit code was identified at time of analysis, but successful code execution additionally depends on a usable gadget chain being present on the server classpath, and the vendor priority places remediation in this week's workload.
Unsafe Java deserialization in the OpenSearch SQL plugin allows a remote user holding only basic read/search permissions to run arbitrary code on the node by sending a crafted `cursor` parameter to the `plugins/sql` endpoint. The flaw affects the 2.x line from 2.8.0.0 up to (but not including) 2.19.6.0 and the 3.x line from 3.0.0 up to 3.7.0.0, and it is fixed in releases 2.19.6.0 and 3.7.0.0; the plugin ships enabled by default in OpenSearch distributions, so no unusual configuration is needed to reach the vulnerable path. No public exploit code was identified at time of analysis, but successful code execution additionally depends on a usable gadget chain being present on the server classpath, and the vendor priority places remediation in this week's workload.