PT-2022-3398 · Elastic · Elasticsearch

Published 2022-06-06 · Updated 2024-03-06 · CVE-2022-23712

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 8.0.0 through 8.2.0

Description A Denial of Service flaw was discovered in Elasticsearch, related to insufficient exception handling. This issue can be exploited by an unauthenticated attacker to shut down an Elasticsearch node using a specifically formatted network request.

Recommendations For versions 8.0.0 through 8.2.0, update to version 8.2.1 or later, which contains a patch for this issue. As a temporary workaround, consider restricting access to the Elasticsearch node to minimize the risk of exploitation.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2022-04170

BIT-ELASTICSEARCH-2022-23712

CVE-2022-23712

GHSA-WH6W-69XC-5RQ5

Affected Products

Elasticsearch

References · 11

• https://discuss.elastic.co/t/elastic-stack-7-17-4-and-8-2-1-security-update/305530 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2022-23712 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04170 · Security Note
• https://elastic.co/community/security · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/681286 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23712 · Security Note
• https://osv.dev/vulnerability/GHSA-wh6w-69xc-5rq5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23712 · Vendor Advisory
• https://github.com/elastic/elasticsearch · Note
• https://security.netapp.com/advisory/ntap-20220707-0010 · Note
• https://t.me/cibsecurity/43881 · Telegram Post