Elasticsearch: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 4.9
  CVE-2024-23450

  Elasticsearch Uncontrolled Resource Consumption vulnerability

  A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

  Elastic Elasticsearch trino trino-plugin-opensearch Ubuntu Wolfi Maven
  Mar 27, 2024
• Medium 4.4
  CVE-2024-23451

  Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model

  Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to u…

  Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  Mar 27, 2024

Revision history

1. 2024-11-11 #2

   Prüfung Produkteintragung

2. 2024-03-27 #1

   Initiale Fassung

References

• Elasticsearch Security Update vom 2024-03-27
  https://discuss.elastic.co/t/elasticsearch-8-13-0-security-update-esa-2024-07
• Elasticsearch Security Update vom 2024-03-27
  https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06
• GitHub Advisory Database vom 2024-03-27
  https://github.com/advisories/GHSA-r3hx-qfh5-r9m7
• GitHub Advisory Database vom 2024-03-27
  https://github.com/advisories/GHSA-w5gg-2q56-6h4f