GitHub Advisoryadvisory · Maven

GHSA-pw39-f3m5-cxfc Elasticsearch Uncaught Exception leading to crash

MEDIUM Published 2024-03-29 Modified 2025-05-27 Official page ↗
Aliases
CVE-2024-23449
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-248
Reviewed
2024-03-29

Affected packages

• Maven org.elasticsearch:elasticsearch: >= 8.4.0, < 8.11.1 → fixed in 8.11.1

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Related

Alias · CVE (1)

  • CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the… vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References