Description
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opensearch-project sql
>= 2.8.0.0, < 2.19.6.0affected>= 3.0.0.0-alpha1, < 3.7.0.0affected
References
- https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4 ↗
- https://github.com/opensearch-project/sql/pull/5469 ↗
- https://github.com/opensearch-project/sql/pull/5572 ↗
- https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de ↗
- https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db ↗
- https://github.com/opensearch-project/sql/releases/tag/2.19.6.0 ↗
- https://github.com/opensearch-project/sql/releases/tag/3.7.0.0 ↗