CVE-2018-17244 (retired)

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way
request headers are applied to requests when using the Active Directory,
LDAP, Native, or File realms. A request may receive headers intended for
another request if the same username is being authenticated concurrently;
when used with run as, this can result in the request running as the
incorrect user. This could allow a user to access information that they
should not have access to.
 msalvatore> affects elasticsearch versions 6.5.0, 6.4.1, and 6.4.2
Upstream:not-affected (code not present)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (code not present)
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 18.10 (Cosmic Cuttlefish):DNE
Ubuntu 19.04 (Disco Dingo):DNE
Ubuntu 19.10 (Eoan):DNE
More Information

Updated: 2019-05-31 13:15:00 UTC (commit 54fec9744b1820ffa4a16bede02d76622e8e2801)