CVE-2023-46674: Elasticsearch-hadoop Unsafe Deserialization
First published: Tue Dec 05 2023(Updated: )
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
Credit: bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.elasticsearch:elasticsearch-hadoop | >=8.0.0<8.9.0 | 8.9.0 |
| maven/org.elasticsearch:elasticsearch-hadoop | <7.17.11 | 7.17.11 |
| Elastic | <7.17.11 | |
| Elastic | >=8.0.0<8.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-46674?
CVE-2023-46674 is classified as a high severity vulnerability due to potential exploitation through unsafe deserialization of objects.
Who is affected by CVE-2023-46674?
CVE-2023-46674 affects versions of Elasticsearch Hadoop between 8.0.0 and 8.9.0, as well as version 7.17.11.
How do I fix CVE-2023-46674?
To mitigate CVE-2023-46674, update your Elasticsearch Hadoop to version 8.9.0 or 7.17.11.
What is the nature of the vulnerability CVE-2023-46674?
CVE-2023-46674 involves unsafe deserialization of Java objects that can be manipulated by authenticated users.
Which environments are impacted by CVE-2023-46674?
CVE-2023-46674 impacts environments using Elasticsearch Hadoop alongside the specified vulnerable versions.
- collector/github-advisory-latest
- alias/GHSA-rv74-m283-5j95
- alias/CVE-2023-46674
- collector/github-advisory
- agent/type
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/maven
- vendor/elastic
- canonical/elastic
- version/elastic/8.0.0