Advisoriesby IbisElasticsearchGHSA-3393-hvrj-w7v3
Denial of Service in Elasticsearch
Fix: upgrade to 6.8.17 or later (2 fixed versions below)
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 6.8.17 | 6.8.17 |
| >= 7.0.0-alpha1, < 7.13.3 | 7.13.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-674
- Also known as
- BIT-elasticsearch-2021-22144, CVE-2021-22144
More Elasticsearch advisories
All Elasticsearch
Exposure of sensitive information in ElasticsearchCVE-2021-22147fixed in 7.14.0API information disclosure flaw in ElasticsearchCVE-2021-22135fixed in 6.8.15 +1Insufficiently Protected Credentials in ElasticsearchCVE-2021-22132fixed in 7.10.2Privilege Escalation Flaw in ElasticsearchCVE-2020-7014fixed in 6.8.8 +1Privilege Context Switching Error in ElasticsearchCVE-2020-7020fixed in 6.8.13 +1Exposure of Sensitive Information to an Unauthorized ActorCVE-2021-22134fixed in 7.11.0