CVE-2023-31418
Fixed in a distro release EPSS 2%CVSS 7.5
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 7.17.13 |
| Maven | org.elasticsearch:elasticsearch | 8.9.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | trino | 0 |
| Chainguard | trino-config | 0 |
| Chainguard | trino-oci-entrypoint | 0 |
| Chainguard | trino-plugin-accumulo | 0 |
| Chainguard | trino-plugin-ai-functions | 0 |
| Chainguard | trino-plugin-atop | 0 |
| Chainguard | trino-plugin-bigquery | 0 |
| Chainguard | trino-plugin-blackhole | 0 |
| Chainguard | trino-plugin-cassandra | 0 |
| Chainguard | trino-plugin-clickhouse | 0 |
| Chainguard | trino-plugin-delta-lake | 0 |
| Chainguard | trino-plugin-druid | 0 |
| Chainguard | trino-plugin-duckdb | 0 |
| Chainguard | trino-plugin-elasticsearch | 0 |
| Chainguard | trino-plugin-example-http | 0 |
| Chainguard | trino-plugin-exasol | 0 |
| Chainguard | trino-plugin-exchange-filesystem | 0 |
| Chainguard | trino-plugin-exchange-hdfs | 0 |
| Chainguard | trino-plugin-faker | 0 |
| Chainguard | trino-plugin-functions-python | 0 |
| Chainguard | trino-plugin-geospatial | 0 |
| Chainguard | trino-plugin-google-sheets | 0 |
| Chainguard | trino-plugin-hive | 0 |
| Chainguard | trino-plugin-http-event-listener | 0 |
| Chainguard | trino-plugin-http-server-event-listener | 0 |
| Chainguard | trino-plugin-hudi | 0 |
| Chainguard | trino-plugin-iceberg | 0 |
| Chainguard | trino-plugin-ignite | 0 |
| Chainguard | trino-plugin-jmx | 0 |
| Chainguard | trino-plugin-kafka | 0 |
| Chainguard | trino-plugin-kafka-event-listener | 0 |
| Chainguard | trino-plugin-kinesis | 0 |
| Chainguard | trino-plugin-kudu | 0 |
| Chainguard | trino-plugin-lakehouse | 0 |
| Chainguard | trino-plugin-ldap-group-provider | 0 |
| Chainguard | trino-plugin-local-file | 0 |
| Chainguard | trino-plugin-loki | 0 |
| Chainguard | trino-plugin-mariadb | 0 |
| Chainguard | trino-plugin-memory | 0 |
| Chainguard | trino-plugin-ml | 0 |
| Chainguard | trino-plugin-mongodb | 0 |
| Chainguard | trino-plugin-mysql | 0 |
| Chainguard | trino-plugin-mysql-event-listener | 0 |
| Chainguard | trino-plugin-opa | 0 |
| Chainguard | trino-plugin-openlineage | 0 |
| Chainguard | trino-plugin-opensearch | 0 |
| Chainguard | trino-plugin-oracle | 0 |
| Chainguard | trino-plugin-password-authenticators | 0 |
| Chainguard | trino-plugin-phoenix5 | 0 |
| Chainguard | trino-plugin-pinot | 0 |
| Chainguard | trino-plugin-postgresql | 0 |
| Chainguard | trino-plugin-prometheus | 0 |
| Chainguard | trino-plugin-ranger | 0 |
| Chainguard | trino-plugin-raptor-legacy | 0 |
| Chainguard | trino-plugin-redis | 0 |
| Chainguard | trino-plugin-redshift | 0 |
| Chainguard | trino-plugin-resource-group-managers | 0 |
| Chainguard | trino-plugin-session-property-managers | 0 |
| Chainguard | trino-plugin-singlestore | 0 |
| Chainguard | trino-plugin-snowflake | 0 |
| Chainguard | trino-plugin-spooling-filesystem | 0 |
| Chainguard | trino-plugin-sqlserver | 0 |
| Chainguard | trino-plugin-teradata-functions | 0 |
| Chainguard | trino-plugin-thrift | 0 |
| Chainguard | trino-plugin-tpcds | 0 |
| Chainguard | trino-plugin-tpch | 0 |
| Chainguard | trino-plugin-vertica | 0 |
| Ubuntu 16.04 LTS | elasticsearch | no fix |
| Wolfi | trino | 0 |
| Wolfi | trino-config | 0 |
| Wolfi | trino-oci-entrypoint | 0 |
| Wolfi | trino-plugin-accumulo | 0 |
| Wolfi | trino-plugin-ai-functions | 0 |
| Wolfi | trino-plugin-atop | 0 |
| Wolfi | trino-plugin-bigquery | 0 |
| Wolfi | trino-plugin-blackhole | 0 |
| Wolfi | trino-plugin-cassandra | 0 |
| Wolfi | trino-plugin-clickhouse | 0 |
| Wolfi | trino-plugin-delta-lake | 0 |
| Wolfi | trino-plugin-druid | 0 |
| Wolfi | trino-plugin-duckdb | 0 |
| Wolfi | trino-plugin-elasticsearch | 0 |
| Wolfi | trino-plugin-example-http | 0 |
| Wolfi | trino-plugin-exasol | 0 |
| Wolfi | trino-plugin-exchange-filesystem | 0 |
| Wolfi | trino-plugin-exchange-hdfs | 0 |
| Wolfi | trino-plugin-faker | 0 |
| Wolfi | trino-plugin-functions-python | 0 |
| Wolfi | trino-plugin-geospatial | 0 |
| Wolfi | trino-plugin-google-sheets | 0 |
| Wolfi | trino-plugin-hive | 0 |
| Wolfi | trino-plugin-http-event-listener | 0 |
| Wolfi | trino-plugin-http-server-event-listener | 0 |
| Wolfi | trino-plugin-hudi | 0 |
| Wolfi | trino-plugin-iceberg | 0 |
| Wolfi | trino-plugin-ignite | 0 |
| Wolfi | trino-plugin-jmx | 0 |
| Wolfi | trino-plugin-kafka | 0 |
| Wolfi | trino-plugin-kafka-event-listener | 0 |
| Wolfi | trino-plugin-kinesis | 0 |
| Wolfi | trino-plugin-kudu | 0 |
| Wolfi | trino-plugin-lakehouse | 0 |
| Wolfi | trino-plugin-ldap-group-provider | 0 |
| Wolfi | trino-plugin-local-file | 0 |
| Wolfi | trino-plugin-loki | 0 |
| Wolfi | trino-plugin-mariadb | 0 |
| Wolfi | trino-plugin-memory | 0 |
| Wolfi | trino-plugin-ml | 0 |
| Wolfi | trino-plugin-mongodb | 0 |
| Wolfi | trino-plugin-mysql | 0 |
| Wolfi | trino-plugin-mysql-event-listener | 0 |
| Wolfi | trino-plugin-opa | 0 |
| Wolfi | trino-plugin-openlineage | 0 |
| Wolfi | trino-plugin-opensearch | 0 |
| Wolfi | trino-plugin-oracle | 0 |
| Wolfi | trino-plugin-password-authenticators | 0 |
| Wolfi | trino-plugin-phoenix5 | 0 |
| Wolfi | trino-plugin-pinot | 0 |
| Wolfi | trino-plugin-postgresql | 0 |
| Wolfi | trino-plugin-prometheus | 0 |
| Wolfi | trino-plugin-ranger | 0 |
| Wolfi | trino-plugin-raptor-legacy | 0 |
| Wolfi | trino-plugin-redis | 0 |
| Wolfi | trino-plugin-redshift | 0 |
| Wolfi | trino-plugin-resource-group-managers | 0 |
| Wolfi | trino-plugin-session-property-managers | 0 |
| Wolfi | trino-plugin-singlestore | 0 |
| Wolfi | trino-plugin-snowflake | 0 |
| Wolfi | trino-plugin-spooling-filesystem | 0 |
| Wolfi | trino-plugin-sqlserver | 0 |
| Wolfi | trino-plugin-teradata-functions | 0 |
| Wolfi | trino-plugin-thrift | 0 |
| Wolfi | trino-plugin-tpcds | 0 |
| Wolfi | trino-plugin-tpch | 0 |
| Wolfi | trino-plugin-vertica | 0 |