CVE-2024-52979

MEDIUM6.5EPSS 0.20%

Elasticsearch Uncontrolled Resource Consumption vulnerability

發布日:2025/5/1修改日:2025/10/3

也稱為:GHSA-mm3m-5497-xgggBIT-elasticsearch-2024-52979

描述

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

受影響套件(2)

Bitnami/elasticsearch>= 7.17.0, < 7.17.25, >= 8.0.0, < 8.16.0
Maven/org.elasticsearch:elasticsearchfrom 0, < 7.17.25

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-52979
PATCHhttps://github.com/elastic/elasticsearch
WEBhttps://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709
WEBhttps://github.com/elastic/elasticsearch/commit/cbde7f456d7ccd98556302fccf3238bb4557fc91
WEBhttps://github.com/elastic/elasticsearch/commit/f9b6b57d1d0f76e2d14291c04fb50abeb642cfbf
WEBhttps://github.com/elastic/elasticsearch/pull/114002