CVE-2024-23449

MEDIUM4.3EPSS 0.05%

Elasticsearch Uncaught Exception

發布日:2024/3/29修改日:2025/5/20

也稱為:GHSA-pw39-f3m5-cxfcBIT-elasticsearch-2024-23449

描述

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

受影響套件(2)

Bitnami/elasticsearch>= 8.4.0, < 8.11.1
Maven/org.elasticsearch:elasticsearch>= 8.4.0, < 8.11.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-23449
PATCHhttps://github.com/elastic/elasticsearch
WEBhttps://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458
WEBhttps://github.com/elastic/elasticsearch/commit/a59180459a3cb30b71399d778943cab4ac2191c4
WEBhttps://github.com/elastic/elasticsearch/commit/f9bf18a716613473fc1cb96c838874e1f9f6ba22