org.elasticsearch:elasticsearch 7.0.0-alpha2

Direct Vulnerabilities

Known vulnerabilities in the org.elasticsearch:elasticsearch package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the bulk request processing. An attacker can exhaust system resources and cause service disruption by submitting specially crafted requests that result in sustained high CPU consumption. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.24, 8.15.0 or higher.	[,7.17.24)[8.0.0-alpha1,8.15.0)
M Allocation of Resources Without Limits or Throttling org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `snapshot restore` request due to improper length validation for `rename_replacement`. An attacker can exhaust system memory and disrupt service availability by sending specially crafted HTTP requests. Note: This is only exploitable if the attacker has authenticated access with snapshot restore privileges. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.elasticsearch:elasticsearch` to version 8.19.8, 9.1.8, 9.2.2 or higher.	[7.0.0-alpha1,8.19.8)[9.0.0-beta1,9.1.8)[9.2.0,9.2.2)
M Insertion of Sensitive Information into Log File org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the reindex request due to redacting certain fields from the body of rest requests in audit logs. An attacker can obtain sensitive information by triggering audit logs that capture confidential data during request processing. How to fix Insertion of Sensitive Information into Log File? Upgrade `org.elasticsearch:elasticsearch` to version 8.18.8, 8.19.5, 9.0.8, 9.1.5 or higher.	[,8.18.8)[8.19.0,8.19.5)[9.0.0-beta1,9.0.8)[9.1.0,9.1.5)
H Denial of Service (DoS) org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Denial of Service (DoS) via specifically crafted search templates with Mustache functions. An attacker can cause the Elasticsearch node to crash by sending malicious search templates. How to fix Denial of Service (DoS)? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.25, 8.16.0 or higher.	[,7.17.25)[8.0.0-alpha1,8.16.0)
M Missing Encryption of Sensitive Data org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data when creating a new Certificate Signing Request via the `elasticsearch-certutil` tool with the `csr` option. The private key that is generated is stored on disk unencrypted even if the `--pass` parameter is passed in the command invocation. How to fix Missing Encryption of Sensitive Data? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.23, 8.13.0 or higher.	[,7.17.23)[8.0.0-alpha1,8.13.0)
M Uncontrolled Recursion org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Uncontrolled Recursion when processing a document in a deeply nested pipeline on an ingest node, causing the node to crash. How to fix Uncontrolled Recursion? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.19, 8.13.0 or higher.	[,7.17.19)[8.0.0-alpha1,8.13.0)
H Uncontrolled Resource Consumption ('Resource Exhaustion') org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') when handling incoming requests on the HTTP layer. An attacker can force a node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.13, 8.9.0 or higher.	[,7.17.13)[8.0.0,8.9.0)
M Cross-site Scripting (XSS) org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `Data Preview Pane` which could allow arbitrary JavaScript to be executed in a victim’s browser. How to fix Cross-site Scripting (XSS)? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.1, 8.0.1 or higher.	[,7.17.1)[8.0.0,8.0.1)
L Missing Authorization org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Missing Authorization by allowing users with `Read` access to the `Uptime` feature to modify alerting rules. That being said, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. How to fix Missing Authorization? Upgrade `org.elasticsearch:elasticsearch` to version 7.17.1, 8.0.1 or higher.	[,7.17.1)[8.0.0,8.0.1)
L Information Disclosure org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Information Disclosure. There is an information disclosure issue when audit logging and the `emit_request_body` option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details. How to fix Information Disclosure? Upgrade `org.elasticsearch:elasticsearch` to version 6.8.14, 7.10.0 or higher.	[,6.8.14)[7.0.0-alpha1,7.10.0)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the bulk request processing. An attacker can exhaust system resources and cause service disruption by submitting specially crafted requests that result in sustained high CPU consumption.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.elasticsearch:elasticsearch to version 7.17.24, 8.15.0 or higher.

[,7.17.24)[8.0.0-alpha1,8.15.0)

Allocation of Resources Without Limits or Throttling

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the snapshot restore request due to improper length validation for rename_replacement. An attacker can exhaust system memory and disrupt service availability by sending specially crafted HTTP requests.

Note:

This is only exploitable if the attacker has authenticated access with snapshot restore privileges.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.elasticsearch:elasticsearch to version 8.19.8, 9.1.8, 9.2.2 or higher.

[7.0.0-alpha1,8.19.8)[9.0.0-beta1,9.1.8)[9.2.0,9.2.2)

Insertion of Sensitive Information into Log File

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the reindex request due to redacting certain fields from the body of rest requests in audit logs. An attacker can obtain sensitive information by triggering audit logs that capture confidential data during request processing.

How to fix Insertion of Sensitive Information into Log File?

Upgrade org.elasticsearch:elasticsearch to version 8.18.8, 8.19.5, 9.0.8, 9.1.5 or higher.

[,8.18.8)[8.19.0,8.19.5)[9.0.0-beta1,9.0.8)[9.1.0,9.1.5)

Denial of Service (DoS)

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Denial of Service (DoS) via specifically crafted search templates with Mustache functions. An attacker can cause the Elasticsearch node to crash by sending malicious search templates.

How to fix Denial of Service (DoS)?

Upgrade org.elasticsearch:elasticsearch to version 7.17.25, 8.16.0 or higher.

[,7.17.25)[8.0.0-alpha1,8.16.0)

Missing Encryption of Sensitive Data

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data when creating a new Certificate Signing Request via the elasticsearch-certutil tool with the csr option. The private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

How to fix Missing Encryption of Sensitive Data?

Upgrade org.elasticsearch:elasticsearch to version 7.17.23, 8.13.0 or higher.

[,7.17.23)[8.0.0-alpha1,8.13.0)

Uncontrolled Recursion

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Uncontrolled Recursion when processing a document in a deeply nested pipeline on an ingest node, causing the node to crash.

How to fix Uncontrolled Recursion?

Upgrade org.elasticsearch:elasticsearch to version 7.17.19, 8.13.0 or higher.

[,7.17.19)[8.0.0-alpha1,8.13.0)

Uncontrolled Resource Consumption ('Resource Exhaustion')

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') when handling incoming requests on the HTTP layer. An attacker can force a node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.

How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

Upgrade org.elasticsearch:elasticsearch to version 7.17.13, 8.9.0 or higher.

[,7.17.13)[8.0.0,8.9.0)

Cross-site Scripting (XSS)

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Data Preview Pane which could allow arbitrary JavaScript to be executed in a victim’s browser.

How to fix Cross-site Scripting (XSS)?

Upgrade org.elasticsearch:elasticsearch to version 7.17.1, 8.0.1 or higher.

[,7.17.1)[8.0.0,8.0.1)

Missing Authorization

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Missing Authorization by allowing users with Read access to the Uptime feature to modify alerting rules. That being said, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors.

How to fix Missing Authorization?

Upgrade org.elasticsearch:elasticsearch to version 7.17.1, 8.0.1 or higher.

[,7.17.1)[8.0.0,8.0.1)

Information Disclosure

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Information Disclosure. There is an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

How to fix Information Disclosure?

Upgrade org.elasticsearch:elasticsearch to version 6.8.14, 7.10.0 or higher.

[,6.8.14)[7.0.0-alpha1,7.10.0)

org.elasticsearch:elasticsearch@7.0.0-alpha2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically