CVE-2023-46673
First published: Wed Nov 22 2023(Updated: )
Elastic Elasticsearch is vulnerable to a denial of service, caused by improper handling of exceptional conditions. By sending a specially crafted request using the Simulate Pipeline API, a remote authenticated attacker could exploit this vulnerability to cause an Elasticsearch node to crash.
Credit: bressers@elastic.co bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.elasticsearch:elasticsearch | >=8.0.0<8.10.3 | 8.10.3 |
| maven/org.elasticsearch:elasticsearch | >=7.0.0<7.17.14 | 7.17.14 |
| Elastic Elasticsearch | >=7.0.0<7.17.14 | |
| Elastic Elasticsearch | >=8.0.0<8.10.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708
- https://www.elastic.co/community/security
- https://nvd.nist.gov/vuln/detail/CVE-2023-46673
- https://github.com/advisories/GHSA-285m-vhfq-xx4h (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/272207
- https://www.ibm.com/support/pages/node/7114419 (Advisory)
Frequently Asked Questions
What is CVE-2023-46673?
CVE-2023-46673 is a vulnerability that allows malformed scripts used in the script processor of an Ingest Pipeline to crash an Elasticsearch node when calling the Simulate Pipeline API.
What software is affected by CVE-2023-46673?
Elasticsearch versions between 7.0.0 and 7.17.14, and versions between 8.0.0 and 8.10.3 are affected by CVE-2023-46673.
What is the severity of CVE-2023-46673?
CVE-2023-46673 has a severity rating of 6.5 (medium).
How can I fix CVE-2023-46673?
To fix CVE-2023-46673, update your Elasticsearch installation to version 7.17.14 or 8.10.3.
Where can I find more information about CVE-2023-46673?
You can find more information about CVE-2023-46673 at the following references: [Discuss Elastic Community](https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708), [Elastic Community Security](https://www.elastic.co/community/security), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-46673).
- collector/github-advisory-latest
- alias/GHSA-285m-vhfq-xx4h
- alias/CVE-2023-46673
- collector/nvd-cve
- collector/nvd-api
- collector/github-advisory
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/trending
- package-manager/maven
- vendor/elastic
- canonical/elastic elasticsearch
- version/elastic elasticsearch/7.0.0
- version/elastic elasticsearch/8.0.0