CVE-2024-23444 — Missing Encryption of Sensitive Data in Elasticsearch

CWE-311 — Missing Encryption of Sensitive Data5 documents4 sources
Severity
7.5HIGHNVD
CNA4.9
EPSS
1.2%
top 20.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedJul 31

Description

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5elastic/elasticsearch7.x — 7.17.23+1
▶NVDelastic/elasticsearch7.0.0 — 7.17.23+1

🔴Vulnerability Details

4
GHSA
Elasticsearch stores private key on disk unencrypted↗2024-07-31
▶
OSV
Elasticsearch stores private key on disk unencrypted↗2024-07-31
▶
OSV
CVE-2024-23444: It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Si↗2024-07-31
▶
CVEList
Elasticsearch elasticsearch-certutil csr fails to encrypt private key↗2024-07-31
▶
CVE-2024-23444 — Missing Encryption of Sensitive Data | cvebase