CVE-2021-37941

Advisory

A local privilege escalation vulnerability was identified in the APM Java agent, potentially also affecting the elastic-apm Python module, which shares identical release version numbers. This vulnerability allows a system user to attach a malicious file to an application monitored by the APM agent, thereby enabling them to execute commands at a higher permission level than their own. It specifically impacts configurations using the attacher CLI (version 3), the attach API (version 2), or those with the 'profiling_inferred_spans_enabled' option active.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://discuss.elastic.co/t/apm-java-agent-security-update/289627
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37941