Elasticsearch Improper Handling of Exceptional Conditions

CVE-2023-46673 · Published Nov 22, 2023 · updated Feb 16, 2024

Medium6.5

Fix: upgrade to 7.17.14 or later (2 fixed versions below)

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Affected versions

Package	Affected	Fixed in
org.elasticsearch:elasticsearch Maven	>= 7.0.0, < 7.17.14	7.17.14
	>= 8.0.0, < 8.10.3	8.10.3

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-755
Also known as: BIT-elasticsearch-2023-46673, CVE-2023-46673

More Elasticsearch advisories

All Elasticsearch

Medium 4.3Mar 29, 2024

Elasticsearch Uncaught Exception leading to crashCVE-2024-23449fixed in 8.11.1 Medium 4.4Mar 27, 2024

Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-23451fixed in 8.13.0 Medium 4.9Mar 27, 2024

Elasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-23450fixed in 7.17.19 +1 High 7.5Oct 26, 2023

Elasticsearch vulnerable to Uncontrolled Resource ConsumptionCVE-2023-31418fixed in 7.17.13 +1 Medium 4.1Oct 26, 2023

Elasticsearch allows insertion of sensitive information into log files when using deprecated URIsCVE-2023-31417fixed in 7.17.13 +1 Medium 6.5Oct 26, 2023

Elasticsearch vulnerable to stack overflow in the search APICVE-2023-31419fixed in 7.17.13 +1