ByteOS Network

NVD Vulnerability Details :

CVE-2021-22133

Analyzed

Source-bressers@elastic.co

Published At-10 Feb, 2021 | 19:15

Updated At-16 Feb, 2021 | 20:27

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	2.4	LOW	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary	2.0	2.7	LOW	AV:A/AC:L/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 2.4

Base severity: LOW

Vector:

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 2.0

Base score: 2.7

Base severity: LOW

Vector:

AV:A/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

Elasticsearch BV

>>apm_agent>>Versions before 1.11.0(exclusive)

cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:go:*:*

Weaknesses

CWE ID	Type	Source
CWE-532	Primary	nvd@nist.gov
CWE-532	Secondary	bressers@elastic.co

CWE ID: CWE-532

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-532

Type: Secondary

Source: bressers@elastic.co

References

Hyperlink	Source	Resource
https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252	bressers@elastic.co	Release Notes Vendor Advisory

Hyperlink: https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252

Source: bressers@elastic.co

Resource:

Release Notes

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History