Lucene search

K
osvGoogleOSV:BIT-ELASTICSEARCH-2024-23449
HistoryMay 14, 2024 - 7:17 a.m.

BIT-elasticsearch-2024-23449

2024-05-1407:17:25
Google
osv.dev
7
elasticsearch
pdf
attachment processor
ingest node
crash
encrypted files
rest api

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.8%

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

CPENameOperatorVersion
elasticsearchge8.4.0
elasticsearchlt8.11.1

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.8%

Related for OSV:BIT-ELASTICSEARCH-2024-23449