CVE-2018-3825: Elastic Cloud Enterprise (ECE), слаба криптография

Описание

Оригинално описание

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.

Засегнати продукти

• Elastic Elastic Cloud Enterprise (ECE): before 1.1.4

Вид слабост

• CWE-321 Използване на твърдо кодиран криптографски ключ

История

Други уязвимости в Elastic Elastic Cloud Enterprise (ECE)

• 8.8CVE-2025-37736
• 9.1CVE-2025-37729

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2018-3825
• https://nvd.nist.gov/vuln/detail/CVE-2018-3825
• https://www.elastic.co/community/security
• https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778