AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticsearchGHSA-qwrx-45xf-jjf7

Elasticsearch vulnerable to stack overflow in the search API

Elasticsearch

CVE-2023-31419 · Published Oct 26, 2023 · updated Feb 22, 2024

Medium6.5
Fix: upgrade to 7.17.13 or later (2 fixed versions below)
GitHub advisory

A flaw was discovered in Elasticsearch affecting the _search API that allowed a specially crafted query string to cause a stack overflow and ultimately a denial of service.

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
>= 7.0.0, < 7.17.137.17.13
>= 8.0.0, < 8.9.18.9.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-121, CWE-787
Also known as
BIT-elasticsearch-2023-31419, CVE-2023-31419

More Elasticsearch advisories

All Elasticsearch
Medium 4.3Mar 29, 2024Elasticsearch Uncaught Exception leading to crashCVE-2024-23449fixed in 8.11.1Medium 4.4Mar 27, 2024Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-23451fixed in 8.13.0Medium 4.9Mar 27, 2024Elasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-23450fixed in 7.17.19 +1Medium 6.5Nov 22, 2023Elasticsearch Improper Handling of Exceptional ConditionsCVE-2023-46673fixed in 7.17.14 +1High 7.5Oct 26, 2023Elasticsearch vulnerable to Uncontrolled Resource ConsumptionCVE-2023-31418fixed in 7.17.13 +1Medium 4.1Oct 26, 2023Elasticsearch allows insertion of sensitive information into log files when using deprecated URIsCVE-2023-31417fixed in 7.17.13 +1