K000151528: Elasticsearch vulnerability CVE-2024-43709

Security Advisory Description An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. CVE-2024-43709 Impact There is no impact; F5 products are not affected by this...

Elasticsearch 8.0.x < 8.13.3 / 7.17.21 (ESA-2024-25)

The version of Elasticsearch installed on the remote host is prior to 7.17.21 or 8.13.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2024-25 advisory. - An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception...

com.floragunn:search-guard-5 (5.6.13-19.2), com.floragunn:search-guard-ssl (5.6.13-23) +16 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (5.6.13)

org.elasticsearch:elasticsearch MAVEN version 5.6.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.floragunn:search-guard-5 5.6.13-19.2 - com.floragunn:search-guard-ssl 5.6.13-23 -...

fr.jetoile.hadoop:hadoop-unit-elasticsearch (1.3), org.elasticsearch.plugin:analysis-icu (5.0.0-alpha2) +22 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (5.0.0-alpha2)

org.elasticsearch:elasticsearch MAVEN version 5.0.0-alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - fr.jetoile.hadoop:hadoop-unit-elasticsearch 1.3 - org.elasticsearch.plugin:analysis-icu...

com.automattic:elasticsearch-statsd (>=5.2.2.0, <=5.2.2.1), com.floragunn:dlic-search-guard-module-kibana-multitenancy (>=5.2-1-beta2, <=5.2-2) +60 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (5.2.2)

org.elasticsearch:elasticsearch MAVEN version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.automattic:elasticsearch-statsd =5.2.2.0, =5.2-1-beta2, =5.2.2-11, =5.2.2-20, =1.1.0-release,...

com.bazaarvoice.elasticsearch.client:es-rest-client-aggregations-support-1.3 (>=0.1pre4, <=0.1pre6), com.bazaarvoice.elasticsearch.client:es-rest-client-core-1.3 (>=0.1pre4, <=0.1pre6) +2 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.3.9)

org.elasticsearch:elasticsearch MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.bazaarvoice.elasticsearch.client:es-rest-client-aggregations-support-1.3 =0.1pre4, =0.1pre4,...

com.bowriverstudio:fscrawler-elasticsearch-client-v5 (2.6), com.bowriverstudio:fscrawler-es5 (2.6) +74 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (5.6.15)

org.elasticsearch:elasticsearch MAVEN version 5.6.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.bowriverstudio:fscrawler-elasticsearch-client-v5 2.6 - com.bowriverstudio:fscrawler-es5 2.6 ...

com.sksamuel.elastic4s:elastic4s_2.10 (1.0.3.0) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.0.3)

org.elasticsearch:elasticsearch MAVEN version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.sksamuel.elastic4s:elastic4s2.10 1.0.3.0 Source cves: CVE-2024-43709 Source advisory:...

com.sksamuel.elastic4s:elastic4s-embedded_2.11 (>=6.0.0-m3, <=6.0.0-m4), com.sksamuel.elastic4s:elastic4s-embedded_2.12 (>=6.0.0-m3, <=6.0.0-m4) +14 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.0.0-beta1)

org.elasticsearch:elasticsearch MAVEN version 6.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.sksamuel.elastic4s:elastic4s-embedded2.11 =6.0.0-m3, =6.0.0-m3, =6.0.0-m3, =6.0.0-m3,...

com.clever-age:play2-elasticsearch (1.1.0), com.github.joschi:dropwizard-elasticsearch (0.3.0) +32 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.1.0)

org.elasticsearch:elasticsearch MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.clever-age:play2-elasticsearch 1.1.0 - com.github.joschi:dropwizard-elasticsearch 0.3.0 -...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2024-43709 Source advisory:...

org.elasticsearch:elasticsearch-analysis-icu (0.18.2), org.elasticsearch:elasticsearch-cloud-aws (0.18.2) +11 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.18.2)

org.elasticsearch:elasticsearch MAVEN version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.18.2 - org.elasticsearch:elasticsearch-cloud-aws...

org.elasticsearch:elasticsearch-transport-wares (1.2.0) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.19.0.rc2)

org.elasticsearch:elasticsearch MAVEN version 0.19.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-transport-wares 1.2.0 Source cves: CVE-2024-43709 Source...

com.sksamuel.elastic4s:elastic4s-core_2.10 (1.7.0), com.sksamuel.elastic4s:elastic4s-core_2.11 (1.7.0) +33 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.7.0)

org.elasticsearch:elasticsearch MAVEN version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.sksamuel.elastic4s:elastic4s-core2.10 1.7.0 - com.sksamuel.elastic4s:elastic4s-core2.11 1.7.0...

com.automattic:elasticsearch-statsd (5.6.1.0), com.floragunn:search-guard-ssl (5.6.1-23) +106 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (5.6.1)

org.elasticsearch:elasticsearch MAVEN version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.automattic:elasticsearch-statsd 5.6.1.0 - com.floragunn:search-guard-ssl 5.6.1-23 -...

com.automattic:elasticsearch-statsd (2.0.2.0), com.code972.hebmorph:elasticsearch-analysis-hebrew (>=2.0, <=2.0.1) +34 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (2.0.2)

org.elasticsearch:elasticsearch MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.automattic:elasticsearch-statsd 2.0.2.0 - com.code972.hebmorph:elasticsearch-analysis-hebrew...

org.dspace.modules:additions (>=3.0-rc2, <=3.6), org.dspace.modules:jspui (>=3.0-rc1, <=3.6) +27 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.18.6)

org.elasticsearch:elasticsearch MAVEN version 0.18.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.dspace.modules:additions =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc2, =3.0-rc1, =3.0-rc1, =3.0-rc...

com.alibaba.ververica:ververica-connector-elasticsearch6 (1.15-vvr-6.0.2-3), com.drobisch:flink-connector-elasticsearch6 (>=4.0.0-serde-fixes, <=4.0.5-fault-tolerant) +14 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.8.20)

org.elasticsearch:elasticsearch MAVEN version 6.8.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.alibaba.ververica:ververica-connector-elasticsearch6 1.15-vvr-6.0.2-3 -...

com.amazon.opendistroforelasticsearch:opendistro_security (0.9.0.0), com.amazon.opendistroforelasticsearch:opendistro_security_advanced_modules (0.9.0.0) +40 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.7.1)

org.elasticsearch:elasticsearch MAVEN version 6.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.amazon.opendistroforelasticsearch:opendistrosecurity 0.9.0.0 -...

com.github.alexcojocaru:elasticsearch-maven-plugin (1.4), com.github.joschi:dropwizard-elasticsearch (0.2.1) +2 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.0.2)

org.elasticsearch:elasticsearch MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.alexcojocaru:elasticsearch-maven-plugin 1.4 - com.github.joschi:dropwizard-elasticsear...