BIT-elasticsearch-2024-23449

vendorUSosv

Elasticsearch Uncaught Exception

view advisory published 2024-05-14Licence: per source

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-23449US	medium5.3	0.68% (52nd)	—	2024-03-29
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node t…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-23449WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan