← Back

CVE-2024-23449

nvd nist
Published: Mar 29, 2024Modified: Feb 4, 2025

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Affected (1)

Elastic
1 product
Elasticsearch
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Elasticsearch
From 8.4.0 to 8.11.1

Related CWEs

CWE-248
Uncaught Exception
An exception is thrown from a function, but it is not caught.

References (2)

Source: security@elastic.co
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.