K000151528: Elasticsearch vulnerability CVE-2024-43709

Security Advisory Description An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. CVE-2024-43709 Impact There is no impact; F5 products are not affected by this...

Elasticsearch 8.0.x < 8.13.3 / 7.17.21 (ESA-2024-25)

The version of Elasticsearch installed on the remote host is prior to 7.17.21 or 8.13.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2024-25 advisory. - An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception...

com.floragunn:dlic-search-guard-enterprise-modules (>=6.1.4-31.3, <=6.1.4-31.4), com.floragunn:dlic-search-guard-module-auditlog (>=6.1.4-20.1, <=6.1.4-20.3) +25 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.1.4)

org.elasticsearch:elasticsearch MAVEN version 6.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.floragunn:dlic-search-guard-enterprise-modules =6.1.4-31.3, =6.1.4-20.1, =6.1.4-22.0,...

com.alibaba.ververica:ververica-connector-elasticsearch6 (1.15-vvr-6.0.2-3), com.drobisch:flink-connector-elasticsearch6 (>=4.0.0-serde-fixes, <=4.0.5-fault-tolerant) +14 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.8.20)

org.elasticsearch:elasticsearch MAVEN version 6.8.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.alibaba.ververica:ververica-connector-elasticsearch6 1.15-vvr-6.0.2-3 -...

com.github.chytreg:elasticsearch-analysis-morfologik (2.3.0), com.github.lbroudoux.elasticsearch:amazon-s3-river (1.3.0) +24 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.3.0)

org.elasticsearch:elasticsearch MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.chytreg:elasticsearch-analysis-morfologik 2.3.0 -...

com.automattic:elasticsearch-statsd (>=2.3.1.0, <=2.3.1.1), com.digitalpebble.stormcrawler:storm-crawler-elasticsearch (>=0.10, <=1.1.1) +61 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (2.3.1)

org.elasticsearch:elasticsearch MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.automattic:elasticsearch-statsd =2.3.1.0, =0.10, =2.3.1.8, =2.6, =2.8.2 -...

org.elasticsearch.client:transport (6.0.0-alpha1), org.elasticsearch.plugin:lang-mustache-client (6.0.0-alpha1) +5 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.0.0-alpha1)

org.elasticsearch:elasticsearch MAVEN version 6.0.0-alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch.client:transport 6.0.0-alpha1 -...

at.molindo:esi4j (>=3.0.0, <=3.0.2), com.github.dapicard.elasticsearch.curator:elasticsearch-curator (1.7.0.1) +11 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.7.4)

org.elasticsearch:elasticsearch MAVEN version 1.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - at.molindo:esi4j =3.0.0, =2.4.1, =1.2.0, =1.2.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0,...

org.elasticsearch:elasticsearch-transport-wares (1.2.0) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.19.0.rc2)

org.elasticsearch:elasticsearch MAVEN version 0.19.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-transport-wares 1.2.0 Source cves: CVE-2024-43709 Source...

org.elasticsearch:elasticsearch-analysis-icu (0.17.8), org.elasticsearch:elasticsearch-cloud-aws (0.17.8) +11 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.17.8)

org.elasticsearch:elasticsearch MAVEN version 0.17.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.17.8 - org.elasticsearch:elasticsearch-cloud-aws...

org.elasticsearch:elasticsearch-analysis-icu (0.9.0), org.elasticsearch:elasticsearch-client-groovy (0.9.0) +4 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.9.0)

org.elasticsearch:elasticsearch MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.9.0 - org.elasticsearch:elasticsearch-client-groov...

com.automattic:elasticsearch-statsd (>=2.4.1.0, <=2.4.1.1), com.digitalpebble.stormcrawler:storm-crawler-elasticsearch (>=1.2, <=1.4) +96 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (2.4.1)

org.elasticsearch:elasticsearch MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.automattic:elasticsearch-statsd =2.4.1.0, =1.2, =1.21.0, =2.4.1.6, =2.4.1.16, =0.11, =0.29,...

com.sksamuel.elastic4s:elastic4s-embedded_2.11 (>=6.0.0-m3, <=6.0.0-m4), com.sksamuel.elastic4s:elastic4s-embedded_2.12 (>=6.0.0-m3, <=6.0.0-m4) +14 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.0.0-beta1)

org.elasticsearch:elasticsearch MAVEN version 6.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.sksamuel.elastic4s:elastic4s-embedded2.11 =6.0.0-m3, =6.0.0-m3, =6.0.0-m3, =6.0.0-m3,...

org.elasticsearch:elasticsearch-analysis-icu (0.17.10), org.elasticsearch:elasticsearch-cloud-aws (0.17.10) +11 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.17.10)

org.elasticsearch:elasticsearch MAVEN version 0.17.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.17.10 - org.elasticsearch:elasticsearch-cloud-aw...

com.kwince.contribs:osemmanager (0.0.1), org.elasticsearch:elasticsearch-analysis-icu (>=0.18.5, <=1.1.0) +16 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.18.5)

org.elasticsearch:elasticsearch MAVEN version 0.18.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.kwince.contribs:osemmanager 0.0.1 - org.elasticsearch:elasticsearch-analysis-icu =0.18.5,...

de.spinscale:elasticsearch-plugin-suggest (0.19.11-0.1) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.19.11)

org.elasticsearch:elasticsearch MAVEN version 0.19.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - de.spinscale:elasticsearch-plugin-suggest 0.19.11-0.1 Source cves: CVE-2024-43709 Source...

com.github.tlrx:elasticsearch-test (>=0.0.5, <=0.0.6), org.tynamo:tapestry-model-jpa (>=0.5.0, <=0.6.0) potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.20.0.rc1)

org.elasticsearch:elasticsearch MAVEN version 0.20.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.tlrx:elasticsearch-test =0.0.5, =0.5.0, =0.6.0 Source cves: CVE-2024-43709 Source...

co.diji:elasticsearch-mocksolrplugin (1.1.3), com.aconex.scrutineer:scrutineer (>=1.0.1, <=1.0.4) +6 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.19.3)

org.elasticsearch:elasticsearch MAVEN version 0.19.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - co.diji:elasticsearch-mocksolrplugin 1.1.3 - com.aconex.scrutineer:scrutineer =1.0.1, =1.5.0,...

com.github.alexcojocaru:elasticsearch-maven-plugin (1.4), com.github.joschi:dropwizard-elasticsearch (0.2.1) +2 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (1.0.2)

org.elasticsearch:elasticsearch MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.github.alexcojocaru:elasticsearch-maven-plugin 1.4 - com.github.joschi:dropwizard-elasticsear...

org.elasticsearch:elasticsearch-analysis-icu (0.16.3), org.elasticsearch:elasticsearch-cloud-aws (0.16.3) +11 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (0.16.3)

org.elasticsearch:elasticsearch MAVEN version 0.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.16.3 - org.elasticsearch:elasticsearch-cloud-aws...