VulnerableCode Package Details - pkg:gem/opensearch@0.0.1

Search for packages

Vulnerability	Summary	Fixed by
VCID-2mte-5ys1-ekbc Aliases: CVE-2022-41918 GHSA-wmx7-x4jp-9jgg	Incorrect Authorization OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.	1.3.7 Affected by 0 other vulnerabilities. 2.4.0 Affected by 0 other vulnerabilities.
VCID-4bcd-g1mw-43fq Aliases: CVE-2022-31115 GHSA-977c-63xq-cgw3	Unsafe YAML deserialization in opensearch-ruby ### Impact A YAML deserialization in opensearch-ruby 2.0.0 can lead to unsafe deserialization using YAML.load if the response is of type YAML. ### Patches The problem has been patched in opensearch-ruby gem version 2.0.2. ### Workarounds No viable workaround. Please upgrade to 2.0.2	2.0.2 Affected by 0 other vulnerabilities.
VCID-bf8j-s11d-4kd8 Aliases: CVE-2023-31141 GHSA-g8xc-6mf7-h28h	Incorrect Authorization OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.	There are no reported fixed by versions.
VCID-fyj4-m2xs-p7hg Aliases: CVE-2023-25806 GHSA-c6wg-cm5x-rqvj	Observable Discrepancy OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.	There are no reported fixed by versions.
VCID-s1m1-46b8-4bd6 Aliases: CVE-2023-45807 GHSA-72q2-gwwf-6hrv	Improper Preservation of Permissions OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.	1.3.14 Affected by 0 other vulnerabilities. 2.11.0 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-2mte-5ys1-ekbc
Aliases:
CVE-2022-41918
GHSA-wmx7-x4jp-9jgg

Incorrect Authorization OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.

1.3.7
Affected by 0 other vulnerabilities.

2.4.0
Affected by 0 other vulnerabilities.

VCID-4bcd-g1mw-43fq
Aliases:
CVE-2022-31115
GHSA-977c-63xq-cgw3

Unsafe YAML deserialization in opensearch-ruby ### Impact A YAML deserialization in opensearch-ruby 2.0.0 can lead to unsafe deserialization using YAML.load if the response is of type YAML. ### Patches The problem has been patched in opensearch-ruby gem version 2.0.2. ### Workarounds No viable workaround. Please upgrade to 2.0.2

2.0.2
Affected by 0 other vulnerabilities.

VCID-bf8j-s11d-4kd8
Aliases:
CVE-2023-31141
GHSA-g8xc-6mf7-h28h

Incorrect Authorization OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.

There are no reported fixed by versions.

VCID-fyj4-m2xs-p7hg
Aliases:
CVE-2023-25806
GHSA-c6wg-cm5x-rqvj

Observable Discrepancy OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs. Patches were released in versions 1.3.9 and 2.6.0, there are no workarounds.

There are no reported fixed by versions.

VCID-s1m1-46b8-4bd6
Aliases:
CVE-2023-45807
GHSA-72q2-gwwf-6hrv

Improper Preservation of Permissions OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.

1.3.14
Affected by 0 other vulnerabilities.

2.11.0
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T04:13:36.160445+00:00	GitLab Importer	Affected by	VCID-s1m1-46b8-4bd6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/opensearch/CVE-2023-45807.yml	38.6.0
2026-06-06T03:44:49.319585+00:00	GitLab Importer	Affected by	VCID-bf8j-s11d-4kd8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/opensearch/CVE-2023-31141.yml	38.6.0
2026-06-06T03:31:38.273987+00:00	GitLab Importer	Affected by	VCID-fyj4-m2xs-p7hg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/opensearch/CVE-2023-25806.yml	38.6.0
2026-06-06T03:11:08.471971+00:00	GitLab Importer	Affected by	VCID-2mte-5ys1-ekbc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/opensearch/CVE-2022-41918.yml	38.6.0
2026-06-06T02:39:50.131931+00:00	GitLab Importer	Affected by	VCID-4bcd-g1mw-43fq	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/opensearch/CVE-2022-31115.yml	38.6.0