CVE-2024-23450
published 2024-03-27CVE-2024-23450: A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.94%
56.6th percentile
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 7.0.0 < 7.17.19 | 7.17.19 |
| elastic | elasticsearch | >= 8.0.0 < 8.13.0 | 8.13.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
elasticsearch: Possible denial of service when processing documents in a deeply nested pipeline
vendor_redhat·2024-03-27·CVSS 4.9
CVE-2024-23450 [MEDIUM] CWE-400 elasticsearch: Possible denial of service when processing documents in a deeply nested pipeline
elasticsearch: Possible denial of service when processing documents in a deeply nested pipeline
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
A flaw was found in elasticsearch. Trying to process a document in a deeply nested pipeline may cause the related ingest node to crash, resulting in a Denial of Service.
Package: openshift-logging/fluentd-rhel9 (Logging Subsystem for Red Hat OpenShift) - Not affected
Package: openshift-logging/kibana6-rhel8 (Logging Subsystem for Red Hat OpenShift) - Not affected
Package: openstack-panko (Red Hat OpenStack Platform 16.1) - Not affected
Package: openstack-panko (Red Hat OpenStack Platform 16.2) - Not affected
Package: quay/quay-rhel8
GHSA
Elasticsearch Uncontrolled Resource Consumption vulnerability
ghsa·2024-03-27
CVE-2024-23450 [MEDIUM] CWE-400 Elasticsearch Uncontrolled Resource Consumption vulnerability
Elasticsearch Uncontrolled Resource Consumption vulnerability
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
OSV
Elasticsearch Uncontrolled Resource Consumption vulnerability
osv·2024-03-27
CVE-2024-23450 [MEDIUM] Elasticsearch Uncontrolled Resource Consumption vulnerability
Elasticsearch Uncontrolled Resource Consumption vulnerability
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
OSV
CVE-2024-23450: A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node t
osv·2024-03-27·CVSS 7.5
CVE-2024-23450 [HIGH] CVE-2024-23450: A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node t
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314https://security.netapp.com/advisory/ntap-20240517-0010/https://www.elastic.co/community/securityhttps://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314https://security.netapp.com/advisory/ntap-20240517-0010/https://www.elastic.co/community/security
2024-03-27
Published