org.elasticsearch:elasticsearch@6.8.19 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.elasticsearch:elasticsearch package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Uncontrolled Recursion

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Uncontrolled Recursion when processing a document in a deeply nested pipeline on an ingest node, causing the node to crash.

How to fix Uncontrolled Recursion?

Upgrade org.elasticsearch:elasticsearch to version 7.17.19, 8.13.0 or higher.

[,7.17.19) [8.0.0-alpha1,8.13.0)
  • H
Uncontrolled Resource Consumption ('Resource Exhaustion')

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') when handling incoming requests on the HTTP layer. An attacker can force a node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.

How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

Upgrade org.elasticsearch:elasticsearch to version 7.17.13, 8.9.0 or higher.

[,7.17.13) [8.0.0,8.9.0)
  • M
Cross-site Scripting (XSS)

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Data Preview Pane which could allow arbitrary JavaScript to be executed in a victim’s browser.

How to fix Cross-site Scripting (XSS)?

Upgrade org.elasticsearch:elasticsearch to version 7.17.1, 8.0.1 or higher.

[,7.17.1) [8.0.0,8.0.1)
  • L
Missing Authorization

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Missing Authorization by allowing users with Read access to the Uptime feature to modify alerting rules. That being said, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors.

How to fix Missing Authorization?

Upgrade org.elasticsearch:elasticsearch to version 7.17.1, 8.0.1 or higher.

[,7.17.1) [8.0.0,8.0.1)