OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

Etkilenen sürümler1 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ct/sql/security/advisories/GHSA-r8cv-xvqm-4qj4 Diğer
• github.com/opensearch-project/sql/pull/5469 Diğer
• github.com/opensearch-project/sql/pull/5572 Diğer
• github.com/…ommit/402a284f1dff3545236480b67f860aa93fb667de Diğer
• github.com/…ommit/9ab50384d3ad571a14211415fba2f6d26d4c80db Diğer
• github.com/opensearch-project/sql/releases/tag/2.19.6.0 Diğer
• github.com/opensearch-project/sql/releases/tag/3.7.0.0 Diğer

Kayıt geçmişi

1. 31 Eki 2026 01:22Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-118938Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
• 8,8 CVE-2026-16760Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
• 7,3 CVE-2026-62848Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
• 8,8 CVE-2026-118090WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
• 7,2 CVE-2026-118089WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
• 9,8 CVE-2026-90888WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability