GHSA-285m-vhfq-xx4h BIT-elasticsearch-2023-46673 CVE-2023-46673
Elasticsearch Improper Handling of Exceptional Conditions
- Severity
- 6.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.84%
- Chance of exploitation in the next 30 days. Higher than 57.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-755 Improper Handling of Exceptional Conditions
- Fix
7.17.14- Upgrade org.elasticsearch:elasticsearch to this version or later
Description
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch | >= 7.0.0, < 7.17.14 |
7.17.14 |
| org.elasticsearch:elasticsearch | >= 8.0.0, < 8.10.3 |
8.10.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.elasticsearch:elasticsearch Maven → 7.17.14
- maven
<dependency><groupId>org.elasticsearch</groupId><artifactId>elasticsearch</artifactId><version>7.17.14</version></dependency>- gradle
implementation("org.elasticsearch:elasticsearch:7.17.14")
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-755: Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mrfm-jxgf-2h6v Elasticsearch Improper Access Control vulnerability | High Known exploited | Also affects org.elasticsearch:elasticsearch |
| GHSA-w94p-6mhw-4qxw Improper Access Control in Elasticsearch | High Known exploited | Also affects org.elasticsearch:elasticsearch |
| GHSA-mm3m-5497-xggg Elasticsearch Uncontrolled Resource Consumption Vulnerability | High | Also affects org.elasticsearch:elasticsearch |
| GHSA-5xm9-x7x4-4j5x Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion | High | Also affects org.elasticsearch:elasticsearch |
| GHSA-jgx4-7v3v-vwfm Elasticsearch allocation of resources without limits or throttling leads to crash | High | Also affects org.elasticsearch:elasticsearch |
| GHSA-5mpw-4546-2wcr Elasticsearch Incorrect Authorization vulnerability | Medium | Also affects org.elasticsearch:elasticsearch |
| GHSA-5v8f-xx9m-wj44 Elasticsearch stores private key on disk unencrypted | High | Also affects org.elasticsearch:elasticsearch |
| GHSA-2hjr-vmf3-xwvp Elasticsearch Insertion of Sensitive Information into Log File | Medium | Also affects org.elasticsearch:elasticsearch |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor