Medium WID-SEC-2023-2433 1 CVE

Elasticsearch: Schwachstelle ermöglicht Denial of Service

Published Sep 24, 2023 · Updated Sep 24, 2023 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 1

High 7.5

CVE-2023-31418

Elasticsearch uncontrolled resource consumption

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was…

Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven

Oct 26, 2023

Revision history

2023-09-24 #1
Initiale Fassung

References

Elastic Security Notification vom 2023-09-24
https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616