GHSA-pw39-f3m5-cxfc
Elasticsearch Uncaught Exception leading to crash
At a glance
- Published
- Updated
- CVE
- CVE-2024-23449
- Aliases
- BIT-elasticsearch-2024-23449
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Description
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.elasticsearch:elasticsearch | introduced 8.4.0, fixed 8.11.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-23449 ADVISORY
- https://github.com/elastic/elasticsearch/commit/a59180459a3cb30b71399d778943cab4ac2191c4 WEB
- https://github.com/elastic/elasticsearch/commit/f9bf18a716613473fc1cb96c838874e1f9f6ba22 WEB
- https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458 WEB
- https://github.com/elastic/elasticsearch PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |