CVE-2024-52980
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch:elasticsearch-grok | 8.15.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | camunda-8.8 | 8.8.39-r1 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r13 |
| Chainguard | camunda-zeebe-8.7 | 8.7.41-r1 |
| Chainguard | camunda-zeebe-8.8 | 8.8.39-r1 |
| Chainguard | conductor | 3.31.0-r4 |
| Chainguard | conductor-fips | 3.31.0-r4 |
| Chainguard | elasticsearch-7 | no fix |
| Chainguard | elasticsearch-7-iamguarded | no fix |
| Chainguard | ranger | 2.9.0-r6 |
| Ubuntu 16.04 LTS | elasticsearch | no fix |