CVE-2020-7010 - AskarLabs CVE Database

CVE-2020-7010

Vendor Elastic

Product Elastic Cloud on Kubernetes

Weakness CWE-335

Published June 3, 2020

Last update November 18, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

Key dates

02Disclosure timeline

June 3, 2020 CVE published

November 18, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-7010 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/335.html

Related vulnerabilities

04Related CVE

CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes CVE-2024-1579 Insufficient seeding of random number generator CVE-2022-39218 Random number seed fixed during compilation CVE-2021-34600 Telenot complex: Insecure AES Key Generation CVE-2023-4472 Cryptographically weak PRNG in Opinio 7.22