opensearch - Debian Package Tracker

general

source: opensearch (main)
version: 2.4.1+dfsg-2
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Andrius Merkys [DMD]
arch: all
std-ver: 4.1.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

unstable: 2.4.1+dfsg-2

versioned links

2.4.1+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libopensearch-java

action needed

A new upstream version is available: 3.0.0-beta1 high

A new upstream version 3.0.0-beta1 is available, you should consider packaging it.

Created: 2023-10-22 Last update: 2025-05-24 22:32

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2023-23612: OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. There are no known workarounds for this issue.
CVE-2023-23613: OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields. This issue is only present for authenticated users with read access to the indexes containing the restricted fields. This may expose data which may otherwise not be accessible to the user. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. Users unable to upgrade may write explicit exclusion rules as a workaround. Policies authored in this way are not subject to this issue.
CVE-2023-31141: OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.
CVE-2023-45807: OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.

Created: 2023-10-22 Last update: 2025-02-27 05:02

4 security issues in trixie high

There are 4 open security issues in trixie.

4 important issues:

CVE-2023-23612: OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. There are no known workarounds for this issue.
CVE-2023-23613: OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields. This issue is only present for authenticated users with read access to the indexes containing the restricted fields. This may expose data which may otherwise not be accessible to the user. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. Users unable to upgrade may write explicit exclusion rules as a workaround. Policies authored in this way are not subject to this issue.
CVE-2023-31141: OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.
CVE-2023-45807: OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.

Created: 2023-10-28 Last update: 2023-10-28 18:09

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 20-day delay is over. Check why.

Created: 2024-04-17 Last update: 2025-05-25 00:01

Depends on packages which need a new maintainer normal

The packages that opensearch depends on which need a new maintainer are:

jts (#884537)
- Depends: libjts-java
- Build-Depends: libjts-java

Created: 2023-10-22 Last update: 2025-05-24 22:01

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.12.0+dfsg-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 005f8516ac60a0b43908ed5b2af087630206ee79
Author: Andrius Merkys <merkys@debian.org>
Date:   Mon Mar 4 09:57:22 2024 -0500

    Move to Debian Java Maintainers.

commit 994ced04e99cccdcb6e01bfa7cf24f520febc594
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 04:27:24 2024 -0500

    Add new dependencies.

commit 2acfb1d70268ea273dcbd7efbe6a512a3bb4df2b
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 03:16:56 2024 -0500

    Mention Elasticsearch in debian/copyright.

commit 47e155b01867611eadeaa6ad8d70968ee3988fd3
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 03:15:24 2024 -0500

    Update debian/copyright.

commit 06ca00c2fe156756cf590d421e3e61889a1803e7
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 02:27:36 2024 -0500

    *.exe files are excluded already.

commit 23ae214da3ba2173889747b562ad10dc453912dd
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 02:20:33 2024 -0500

    Update debian/fill-gradle-template.

commit e48768a5249d01a104f4f1107a0916c9a3fd405d
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 02:08:39 2024 -0500

    Update changelog for 2.12.0+dfsg-1 release

commit ff21e2e5c57590f3d435707122bd21bce0d3c1d0
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 02:08:19 2024 -0500

    Refresh patches.

commit 48d118fc51110dc17de62c9a19495d55d4a27fdc
Merge: 498e4ca 85fa0e8
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 02:06:45 2024 -0500

    Update upstream source from tag 'upstream/2.12.0+dfsg'
    
    Update to upstream version '2.12.0+dfsg'
    with Debian dir 5586b30b0aaac5cbd2f1d6eb5ebe8bd8a7cf821d

commit 85fa0e8bf9e2c3100811ce8a5b0e8ee565397545
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Mar 1 02:06:13 2024 -0500

    New upstream version 2.12.0+dfsg

Created: 2024-03-01 Last update: 2025-05-22 20:02

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 2.4.1+dfsg-2 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-11-19 Last update: 2023-11-19 09:40

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.1.3).

Created: 2023-10-22 Last update: 2025-02-27 13:24

testing migrations

excuses:
- Migration status for opensearch (- to 2.4.1+dfsg-2): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating opensearch would introduce bugs in testing: #1066450
- ∙ ∙ blocked by freeze: is not in testing
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/o/opensearch.html
- ∙ ∙ 580 days old (needed 20 days)
- Not considered

news

[rss feed]

[2024-04-18] opensearch REMOVED from testing (Debian testing watch)
[2023-10-28] opensearch 2.4.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-10-23] Accepted opensearch 2.4.1+dfsg-2 (source) into unstable (Andrius Merkys)
[2023-10-21] Accepted opensearch 2.4.1+dfsg-1 (source all) into unstable (Debian FTP Masters) (signed by: Andrius Merkys)

bugs [bug history graph]

all: 2
RC: 1
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs
popcon
browse source code
edit tags
other distros
security tracker
debian patches