PT-2023-5274 · Elastic · Elasticsearch

Rodrigo_Silva · Publicado 2023-09-18 · Atualizado 2024-03-06 · CVE-2023-31419

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The vulnerability is related to reading data beyond the buffer boundaries in memory. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service by sending a specially crafted API request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

BDU:2023-05895

BIT-ELASTICSEARCH-2023-31419

CVE-2023-31419

GHSA-QWRX-45XF-JJF7

Produtos afetados

Elasticsearch

Referências · 23

• 🔥 https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419 · Exploit
• 🔥 https://github.com/tahaafarooq/gallery3d-tecno-exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31419 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-31419 · Nota de Segurança
• https://t.me/cibsecurity/72995 · Publicação no Telegram
• https://twitter.com/hack_git/status/1706194599243616276 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2023-31419 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-31419 · Aviso do Fabricante
• https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297 · Aviso do Fabricante
• https://twitter.com/vxremalware/status/1704536362630746524 · Publicação no Twitter
• https://t.me/cybersecuritytechnologies/9082 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-qwrx-45xf-jjf7 · Aviso do Fabricante
• https://twitter.com/vxremalware/status/1704705586393161986 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-05895 · Nota de Segurança
• https://elastic.co/community/security · Aviso do Fabricante