Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-8WX3-324G-W4QQ
HistoryOct 17, 2023 - 2:24 p.m.

OpenSearch uncontrolled resource consumption

2023-10-1714:24:48
CWE-400
GitHub Advisory Database
github.com
20
opensearch
http layer
resource consumption
unauthenticated user
outofmemory error
elastic engineering
security advisory
fix
aws/amazon security
vulnerability reporting.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

34.7%

JSON

Impact

An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.

The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-13 (CVE-2023-31418).

Mitigation

Versions 1.3.14 and 2.11.0 contain a fix for this issue.

For more information

If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [email protected]. Please do not create a public GitHub issue.

Affected configurations

Vulners
Node
org.opensearch.pluginopensearch-securityRange2.0.0.0–2.11.0.0
OR
org.opensearch.pluginopensearch-securityRange<1.3.14.0
VendorProductVersionCPE
org.opensearch.pluginopensearch-security*cpe:2.3:a:org.opensearch.plugin:opensearch-security:*:*:*:*:*:*:*:*

Related

osv 5
veracode 1
ibm 6
redhatcve 1
github 1
cvelist 1
ubuntucve 1
cve 1
prion 1
nvd 1
osv
osv
CGA-2rh8-vhwq-m8fm
2024-06-06 12:21:12
CVE-2023-31418
2023-10-26 18:15:08
BIT-elasticsearch-2023-31418
2024-03-06 10:51:58
veracode
veracode
Denial Of Service (DoS)
2023-10-27 07:27:04
ibm
ibm
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Elasticsearch denial of service vulnerabilities.
2024-02-05 20:02:50
Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Elastic Elasticsearch denial of service vulnerabilitiy.(CVE-2023-31418)
2024-06-21 15:01:11
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in elasticsearch-7.10.2.jar
2024-09-05 21:54:27
redhatcve
redhatcve
CVE-2023-31418
2023-10-30 11:27:32
github
github
Elasticsearch vulnerable to Uncontrolled Resource Consumption
2023-10-26 18:30:23
cvelist
cvelist
CVE-2023-31418 Elasticsearch uncontrolled resource consumption
2023-10-26 17:36:42
ubuntucve
ubuntucve
CVE-2023-31418
2023-10-26 00:00:00
cve
cve
CVE-2023-31418
2023-10-26 18:15:08
prion
prion
Code injection
2023-10-26 18:15:00
nvd
nvd
CVE-2023-31418
2023-10-26 18:15:08

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

34.7%

JSON
Related for GHSA-8WX3-324G-W4QQ
osv5veracode1ibm6redhatcve1github1cvelist1ubuntucve1cve1prion1nvd1