{"id":"GHSA-285m-vhfq-xx4h","summary":"Elasticsearch Improper Handling of Exceptional Conditions","details":"It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.\n","aliases":["BIT-elasticsearch-2023-46673","CVE-2023-46673"],"modified":"2024-02-16T07:58:09.292811Z","published":"2023-11-22T12:30:26Z","database_specific":{"nvd_published_at":"2023-11-22T10:15:08Z","cwe_ids":["CWE-755"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-11-22T20:57:26Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46673"},{"type":"WEB","url":"https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708"},{"type":"PACKAGE","url":"https://github.com/elastic/elasticsearch"},{"type":"WEB","url":"https://www.elastic.co/community/security"}],"affected":[{"package":{"name":"org.elasticsearch:elasticsearch","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch/elasticsearch"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.17.14"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.11.2","7.12.0","7.12.1","7.13.0","7.13.1","7.13.2","7.13.3","7.13.4","7.14.0","7.14.1","7.14.2","7.15.0","7.15.1","7.15.2","7.16.0","7.16.1","7.16.2","7.16.3","7.17.0","7.17.1","7.17.10","7.17.11","7.17.12","7.17.13","7.17.2","7.17.3","7.17.4","7.17.5","7.17.6","7.17.7","7.17.8","7.17.9","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.4.0","7.4.1","7.4.2","7.5.0","7.5.1","7.5.2","7.6.0","7.6.1","7.6.2","7.7.0","7.7.1","7.8.0","7.8.1","7.9.0","7.9.1","7.9.2","7.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-285m-vhfq-xx4h/GHSA-285m-vhfq-xx4h.json"}},{"package":{"name":"org.elasticsearch:elasticsearch","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch/elasticsearch"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.10.3"}]}],"versions":["8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.1.3","8.10.0","8.10.1","8.10.2","8.2.0","8.2.1","8.2.2","8.2.3","8.3.0","8.3.1","8.3.2","8.3.3","8.4.0","8.4.1","8.4.2","8.4.3","8.5.0","8.5.1","8.5.2","8.5.3","8.6.0","8.6.1","8.6.2","8.7.0","8.7.1","8.8.0","8.8.1","8.8.2","8.9.0","8.9.1","8.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-285m-vhfq-xx4h/GHSA-285m-vhfq-xx4h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}