Advisoriesby IbisElasticsearchGHSA-pw39-f3m5-cxfc
Elasticsearch Uncaught Exception leading to crash
Fix: upgrade to 8.11.1 or later
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | >= 8.4.0, < 8.11.1 | 8.11.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-248
- Also known as
- BIT-elasticsearch-2024-23449, CVE-2024-23449
- nvd.nist.gov/vuln/detail/CVE-2024-23449
- github.com/elastic/elasticsearch/commit/a59180459a3cb30b71399d778943cab4ac2191c4
- github.com/elastic/elasticsearch/commit/f9bf18a716613473fc1cb96c838874e1f9f6ba22
- discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458
- github.com/elastic/elasticsearch
More Elasticsearch advisories
All Elasticsearch
Elasticsearch stores private key on disk unencryptedCVE-2024-23444fixed in 7.17.23 +1Elasticsearch Insertion of Sensitive Information into Log FileCVE-2023-49921fixed in 7.17.16 +1Elasticsearch StackOverflow vulnerabilityCVE-2024-37280fixed in 8.14.0Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-23451fixed in 8.13.0Elasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-23450fixed in 7.17.19 +1Elasticsearch Improper Handling of Exceptional ConditionsCVE-2023-46673fixed in 7.17.14 +1