GitHub Advisoryadvisory · Maven

GHSA-3393-hvrj-w7v3 Denial of Service in Elasticsearch

MEDIUM Published 2021-08-09 Modified 2021-08-02 Official page ↗
Aliases
CVE-2021-22144
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674
Reviewed
2021-08-02

Affected packages

• Maven org.elasticsearch:elasticsearch: < 6.8.17 → fixed in 6.8.17 • Maven org.elasticsearch:elasticsearch: >= 7.0.0-alpha1, < 7.13.3 → fixed in 7.13.3

Description

In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.

Related

Alias · CVE (1)

  • CVE-2021-22144 In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack… vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References