CVE-2024-12539
Fixed in a distro release EPSS <1%CVSS 6.0
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 8.16.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | elasticsearch-8 | 8.17.0-r0 |
| Chainguard | elasticsearch-8-bitnami | 8.17.0-r0 |
| Chainguard | elasticsearch-8-config | 8.17.0-r0 |
| Chainguard | elasticsearch-8-iamguarded | 8.17.0-r0 |
| Chainguard | elasticsearch-config | 8.17.0-r0 |
| Chainguard | elasticsearch-fips-8 | 8.17.0-r0 |
| Chainguard | elasticsearch-fips-8-bitnami | 8.17.0-r0 |
| Chainguard | elasticsearch-fips-8-config | 8.17.0-r0 |
| Chainguard | elasticsearch-fips-8-policy-140-2 | 8.17.0-r0 |
| Chainguard | elasticsearch-fips-8-policy-140-3 | 8.17.0-r0 |
| Chainguard | ruby3.2-elasticsearch | 8.17.0-r0 |
| Chainguard | ruby3.3-elasticsearch | 8.17.0-r0 |
| Ubuntu:16.04:LTS | elasticsearch | no fix |
| Wolfi | ruby3.2-elasticsearch | 8.17.0-r0 |
| Wolfi | ruby3.3-elasticsearch | 8.17.0-r0 |