CVE-2023-46674: Elasticsearch-hadoop Unsafe Deserialization
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46674?
CVE-2023-46674 is classified as a high severity vulnerability due to potential exploitation through unsafe deserialization of objects.
Who is affected by CVE-2023-46674?
CVE-2023-46674 affects versions of Elasticsearch Hadoop between 8.0.0 and 8.9.0, as well as version 7.17.11.
How do I fix CVE-2023-46674?
To mitigate CVE-2023-46674, update your Elasticsearch Hadoop to version 8.9.0 or 7.17.11.
What is the nature of the vulnerability CVE-2023-46674?
CVE-2023-46674 involves unsafe deserialization of Java objects that can be manipulated by authenticated users.
Which environments are impacted by CVE-2023-46674?
CVE-2023-46674 impacts environments using Elasticsearch Hadoop alongside the specified vulnerable versions.