Medium WID-SEC-2024-1739 1 CVE

Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen

Published Jul 31, 2024 · Updated Jul 31, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 1

Medium 4.9

CVE-2024-23444

Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass…

Elastic Elasticsearch trino trino-plugin-opensearch Ubuntu Wolfi Maven

Jul 31, 2024

Revision history

2024-07-31 #1
Initiale Fassung

References

Elasticsearch Security Update vom 2024-07-31
https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12