https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 01:07:03 +0000 https://db.gcve.eu/vuln/ghsa-rrmm-wq7q-h4v5 <p><strong>Affected:</strong> Maven: org.opensearch.plugin:opensearch-security</p> <p>### Impact</p> <p>OpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types `ip`, `geo_point`, `geo_shape`, `xy_point`, `xy_shape`. While the content of these fields is properly redacted in the `_source` document returned by search operations, the original unredacted values remain available to search queries. This allows to reconstruct the original field contents using range queries.</p> <p>Additionally, the content of fields of type `geo_point`, `geo_shape`, `xy_point`, `xy_shape` is returned in an unredacted form if requested via the `fields` option of the search API.</p> <p>### Patches</p> <p>The issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.</p> <p>### Workarounds</p> <p>If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking.</p> <p><strong>Affected:</strong> Maven: org.opensearch.plugin:opensearch-security</p> <p>### Impact</p> <p>OpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types `ip`, `geo_point`, `geo_shape`, `xy_point`, `xy_shape`. While the content of these fields is properly redacted in the `_source` document returned by search operations, the original unredacted values remain available to search queries. This allows to reconstruct the original field contents using range queries.</p> <p>Additionally, the content of fields of type `geo_point`, `geo_shape`, `xy_point`, `xy_shape` is returned in an unredacted form if requested via the `fields` option of the search API.</p> <p>### Patches</p> <p>The issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.</p> <p>### Workarounds</p> <p>If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking.</p> https://db.gcve.eu/vuln/ghsa-rrmm-wq7q-h4v5