CVE-2024-39810 Server crash via Elasticsearch certificate file

Mattermost versions 9.5.x = 9.5.7 and 9.10.x = 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the...

CVE-2024-39810

Mattermost Server vulnerable versions: 9.5.x up to 9.5.7 and 9.10.x up to 9.10.0. The root cause is failure to time/size-limit the CA path file in the Elasticsearch configuration, allowing a System Role with access to the Elasticsearch console to set any file as a CA path (e.g., /dev/zero). After...

PT-2024-28680 · Unknown · Mattermost +1

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.10.x through 9.10.0 Description: The issue arises from the failure to time limit and size limit the CA path file in the ElasticSearch configuration. This allows a System Role with...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial-of-service vulnerability that stems from a failure to time and size limit CA path files in the ElasticSearch configuration, which can be exploited by an attacker to add...

The vulnerability of Elasticsearch’ search engine, a software platform based on Git for collaborative code development on GitLab, allows a hacker to trigger a service failure.

The vulnerability of Elasticsearch, a software platform based on Git for collaborative code development on GitLab, is related to an uncontrolled resource consumption during the processing of search results. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

BIT-GITLAB-2024-7610 Uncontrolled Resource Consumption in GitLab

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

CVE-2024-7610

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

CVE-2024-7610

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

UBUNTU-CVE-2024-7610

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

CVE-2024-7610

Removed by vendor...

CVE-2024-7610 Uncontrolled Resource Consumption in GitLab

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

CVE-2024-7610

CVE-2024-7610 affects GitLab CE/EE; all versions starting with 15.9 before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2 are vulnerable. The DoS arises from catastrophic backtracking during Elasticsearch result parsing. Patches are available: upgrade to 17.0.6, 17.1.4, or 17.2.2 (depending o...

CVE-2024-7610 Uncontrolled Resource Consumption in GitLab

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

CVE-2024-7610 Uncontrolled Resource Consumption in GitLab

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab that stems from vulnerability to...

GitLab 15.9 < 17.0.6 / 17.1 < 17.1.4 / 17.2 < 17.2.2 (CVE-2024-7610)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Elastic Elasticsearch denial of service [ CVE-2024-23450]

Summary Potential Elastic Elasticsearch denial of service CVE-2024-23450 have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-23450 DESCRIPTION...

PT-2024-27448 · Elastic · Apm Server

Name of the Vulnerable Software and Affected Versions: Elastic APM Server versions prior to 8.14.0 Description: The issue concerns the logging of sensitive data by the APM server due to a flaw related to unavailable shards exception. When a bulk index request partially fails, the APM server logs...

BIT-ELASTICSEARCH-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

Missing Encryption Of Sensitive Data

Elasticsearch is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to the elasticsearch-certutil CLI tool storing generated private keys unencrypted on disk when creating Certificate Signing Requests, even if the --pass parameter is used...