Elasticsearch 8.19.x < 8.19.20 / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-80 / ESA-2026-123)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338339);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/20");

  script_cve_id("CVE-2026-72642", "CVE-2026-72678");
  script_cwe_id(823, 789);

  script_name(english:"Elasticsearch 8.19.x < 8.19.20 / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-80 / ESA-2026-123)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.4.x prior to 9.4.5, or 9.5.x
prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-80 and
ESA-2026-123 advisories.

  - The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a
    model operation that computes a memory address from an offset supplied inside the model, without validating
    that the offset stays within the bounds of the underlying storage. A user with the privileges required to
    upload and deploy a trained model can craft a model that reads and writes memory outside the intended
    allocation. The result is heap corruption that crashes the inference process, and, with sufficient control
    over the heap layout, could allow arbitrary code execution in the context of that process. (CVE-2026-72642)

  - Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to
    reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a
    single small crafted request to a product API endpoint that causes the node to attempt an excessively large
    allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node
    process, causing a denial of service for the affected node and degrading cluster health. (CVE-2026-72678)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-80/389507
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8c66571e");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?43fcf937");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.20, 9.4.5, or 9.5.1 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72642");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '8.19.0', 'fixed_version': '8.19.20'},
        {'min_version': '9.4.0', 'fixed_version': '9.4.5'},
        {'min_version': '9.5.0', 'fixed_version': '9.5.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);