Threats tagged 'ghsa-qrp4-c626-6hw2'

An improper certificate validation vulnerability (CWE-295) exists in the operating system certificate bundle included in various Elastic products' Docker images and components. The bundle contains root CAs that trust eight eMudhra intermediate CAs whose private keys have been compromised. An attacker with network access between the product and a remote party could use these compromised keys to issue fraudulent certificates, enabling interception or modification of TLS-protected traffic.