The vulnerability of the _search component of the Elasticsearch search engine allows a hacker to trigger a service failure.

🗓️ 21 Sep 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Elasticsearch _search vulnerability allows remote crafted requests to read beyond buffers and crash the service.

Reporter	Title	Published	Views	Family All 32
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2023	26 Mar 202504:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data	3 Sep 202421:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data	16 Sep 202417:08	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.13 addresses multiple security vulnerabilities.	31 Jul 202411:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable multiple Elasticsearch vulnerabilities.	5 Feb 202420:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to a denial of service CVE-2023-31419	11 Mar 202414:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in elasticsearch-7.10.2.jar	5 Sep 202421:54	–	ibm
0day.today	Elasticsearch 8.5.3 Stack Overflow Exploit	26 Sep 202300:00	–	zdt
0day.today	Elasticsearch - StackOverflow DoS Exploit	11 Feb 202400:00	–	zdt
Circl	CVE-2023-31419	20 Sep 202322:42	–	circl

Vulners

Node

elastic_nv elasticsearchRange8.0.0–8.9.0

OR

elastic_nv elasticsearchRange7.0.0–7.17.12

Source	Link
discuss	www.discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297
elastic	www.elastic.co/community/security
github	www.github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419

13 Oct 2023 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 36.5

CVSS 26.8

EPSS0.60679

Elasticsearch search component buffer overflow remote exploit service crash