Detections
Analytics

SCA: security update for org.opensearch.dataprepper.plugins:opensearch (GHSA-43ff-rr26-8hx4)

high Tenable Self-Hosted Container Security Plugin ID 435633

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to
 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when
 no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would
 automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path
 was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing
 attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability
 affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been
 patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or
 source configuration with the path to the cluster's CA certificate. (CVE-2025-62371)

See Also

https://github.com/advisories/GHSA-43ff-rr26-8hx4

Plugin Details

Severity: High

ID: 435633

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 10/16/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.21

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-62371

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2025

Vulnerability Publication Date: 10/15/2025

Reference Information

CVE: CVE-2025-62371

cwe: CWE-295