Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2024-23449 — MEDIUM severity vulnerability | Release Alert

CVE-2024-23449

4.3

MEDIUMCVSS v3

Published

March 29, 2024

Affected

11 projects

Assigned by

[email protected]

Severity scale

010

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

elastic/elasticsearch

GitHubFree and Open Source, Distributed, RESTful Search Engine

>= 8.4.0, < 8.11.1NVD

elasticsearch

NPMThe official low-level Elasticsearch client for Node.js and the browser.

>= 8.4.0, < 8.11.1NVD

ElasticSearch

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

Elasticsearch is a flexible and powerful open source, distributed, real-time search and analytics engine.

>= 8.4.0, < 8.11.1NVD

Elasticsearch

Chocolatey## The heart of the free and open Elastic Stack Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease. **Please Note**: This is an automatically updated package. If you find it is out of date by more than a day or two, please contact the maintainer(s) and let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.

>= 8.4.0, < 8.11.1NVD