Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-23444

Fixed in a distro release EPSS <1%CVSS 4.9

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

Published 2024-07-31 · CVE record · OSV

Products: Elasticsearch

Fixed upstream

EcosystemPackageFixed in
Mavenorg.elasticsearch:elasticsearch8.13.0
Mavenorg.elasticsearch:elasticsearch7.17.23

Distro releases

ReleasePackageFixed in
Chainguardelasticsearch-77.17.23-r0
Chainguardelasticsearch-7-bitnami7.17.23-r0
Chainguardelasticsearch-7-iamguarded7.17.23-r0
Chainguardtrino453-r1
Chainguardtrino-config453-r1
Chainguardtrino-oci-entrypoint453-r1
Chainguardtrino-plugin-accumulo453-r1
Chainguardtrino-plugin-ai-functions453-r1
Chainguardtrino-plugin-atop453-r1
Chainguardtrino-plugin-bigquery453-r1
Chainguardtrino-plugin-blackhole453-r1
Chainguardtrino-plugin-cassandra453-r1
Chainguardtrino-plugin-clickhouse453-r1
Chainguardtrino-plugin-delta-lake453-r1
Chainguardtrino-plugin-druid453-r1
Chainguardtrino-plugin-duckdb453-r1
Chainguardtrino-plugin-elasticsearch453-r1
Chainguardtrino-plugin-example-http453-r1
Chainguardtrino-plugin-exasol453-r1
Chainguardtrino-plugin-exchange-filesystem453-r1
Chainguardtrino-plugin-exchange-hdfs453-r1
Chainguardtrino-plugin-faker453-r1
Chainguardtrino-plugin-functions-python453-r1
Chainguardtrino-plugin-geospatial453-r1
Chainguardtrino-plugin-google-sheets453-r1
Chainguardtrino-plugin-hive453-r1
Chainguardtrino-plugin-http-event-listener453-r1
Chainguardtrino-plugin-http-server-event-listener453-r1
Chainguardtrino-plugin-hudi453-r1
Chainguardtrino-plugin-iceberg453-r1
Chainguardtrino-plugin-ignite453-r1
Chainguardtrino-plugin-jmx453-r1
Chainguardtrino-plugin-kafka453-r1
Chainguardtrino-plugin-kafka-event-listener453-r1
Chainguardtrino-plugin-kinesis453-r1
Chainguardtrino-plugin-kudu453-r1
Chainguardtrino-plugin-lakehouse453-r1
Chainguardtrino-plugin-ldap-group-provider453-r1
Chainguardtrino-plugin-local-file453-r1
Chainguardtrino-plugin-loki453-r1
Chainguardtrino-plugin-mariadb453-r1
Chainguardtrino-plugin-memory453-r1
Chainguardtrino-plugin-ml453-r1
Chainguardtrino-plugin-mongodb453-r1
Chainguardtrino-plugin-mysql453-r1
Chainguardtrino-plugin-mysql-event-listener453-r1
Chainguardtrino-plugin-opa453-r1
Chainguardtrino-plugin-openlineage453-r1
Chainguardtrino-plugin-opensearch453-r1
Chainguardtrino-plugin-oracle453-r1
Chainguardtrino-plugin-password-authenticators453-r1
Chainguardtrino-plugin-phoenix5453-r1
Chainguardtrino-plugin-pinot453-r1
Chainguardtrino-plugin-postgresql453-r1
Chainguardtrino-plugin-prometheus453-r1
Chainguardtrino-plugin-ranger453-r1
Chainguardtrino-plugin-raptor-legacy453-r1
Chainguardtrino-plugin-redis453-r1
Chainguardtrino-plugin-redshift453-r1
Chainguardtrino-plugin-resource-group-managers453-r1
Chainguardtrino-plugin-session-property-managers453-r1
Chainguardtrino-plugin-singlestore453-r1
Chainguardtrino-plugin-snowflake453-r1
Chainguardtrino-plugin-spooling-filesystem453-r1
Chainguardtrino-plugin-sqlserver453-r1
Chainguardtrino-plugin-teradata-functions453-r1
Chainguardtrino-plugin-thrift453-r1
Chainguardtrino-plugin-tpcds453-r1
Chainguardtrino-plugin-tpch453-r1
Chainguardtrino-plugin-vertica453-r1
Ubuntu 16.04 LTSelasticsearchno fix
Wolfitrino453-r1
Wolfitrino-config453-r1
Wolfitrino-oci-entrypoint453-r1
Wolfitrino-plugin-accumulo453-r1
Wolfitrino-plugin-ai-functions453-r1
Wolfitrino-plugin-atop453-r1
Wolfitrino-plugin-bigquery453-r1
Wolfitrino-plugin-blackhole453-r1
Wolfitrino-plugin-cassandra453-r1
Wolfitrino-plugin-clickhouse453-r1
Wolfitrino-plugin-delta-lake453-r1
Wolfitrino-plugin-druid453-r1
Wolfitrino-plugin-duckdb453-r1
Wolfitrino-plugin-elasticsearch453-r1
Wolfitrino-plugin-example-http453-r1
Wolfitrino-plugin-exasol453-r1
Wolfitrino-plugin-exchange-filesystem453-r1
Wolfitrino-plugin-exchange-hdfs453-r1
Wolfitrino-plugin-faker453-r1
Wolfitrino-plugin-functions-python453-r1
Wolfitrino-plugin-geospatial453-r1
Wolfitrino-plugin-google-sheets453-r1
Wolfitrino-plugin-hive453-r1
Wolfitrino-plugin-http-event-listener453-r1
Wolfitrino-plugin-http-server-event-listener453-r1
Wolfitrino-plugin-hudi453-r1
Wolfitrino-plugin-iceberg453-r1
Wolfitrino-plugin-ignite453-r1
Wolfitrino-plugin-jmx453-r1
Wolfitrino-plugin-kafka453-r1
Wolfitrino-plugin-kafka-event-listener453-r1
Wolfitrino-plugin-kinesis453-r1
Wolfitrino-plugin-kudu453-r1
Wolfitrino-plugin-lakehouse453-r1
Wolfitrino-plugin-ldap-group-provider453-r1
Wolfitrino-plugin-local-file453-r1
Wolfitrino-plugin-loki453-r1
Wolfitrino-plugin-mariadb453-r1
Wolfitrino-plugin-memory453-r1
Wolfitrino-plugin-ml453-r1
Wolfitrino-plugin-mongodb453-r1
Wolfitrino-plugin-mysql453-r1
Wolfitrino-plugin-mysql-event-listener453-r1
Wolfitrino-plugin-opa453-r1
Wolfitrino-plugin-openlineage453-r1
Wolfitrino-plugin-opensearch453-r1
Wolfitrino-plugin-oracle453-r1
Wolfitrino-plugin-password-authenticators453-r1
Wolfitrino-plugin-phoenix5453-r1
Wolfitrino-plugin-pinot453-r1
Wolfitrino-plugin-postgresql453-r1
Wolfitrino-plugin-prometheus453-r1
Wolfitrino-plugin-ranger453-r1
Wolfitrino-plugin-raptor-legacy453-r1
Wolfitrino-plugin-redis453-r1
Wolfitrino-plugin-redshift453-r1
Wolfitrino-plugin-resource-group-managers453-r1
Wolfitrino-plugin-session-property-managers453-r1
Wolfitrino-plugin-singlestore453-r1
Wolfitrino-plugin-snowflake453-r1
Wolfitrino-plugin-spooling-filesystem453-r1
Wolfitrino-plugin-sqlserver453-r1
Wolfitrino-plugin-teradata-functions453-r1
Wolfitrino-plugin-thrift453-r1
Wolfitrino-plugin-tpcds453-r1
Wolfitrino-plugin-tpch453-r1
Wolfitrino-plugin-vertica453-r1