CVE-2024-23444: Elasticsearch elasticsearch-certutil csr fails to encrypt private key
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
Other sources
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23444?
CVE-2024-23444 is classified as a high-severity vulnerability due to the exposure of unencrypted private keys.
How do I fix CVE-2024-23444?
To mitigate CVE-2024-23444, upgrade to Elasticsearch versions 7.17.23 or 8.13.0 or later.
What impact does CVE-2024-23444 have if exploited?
If exploited, CVE-2024-23444 allows unauthorized access to unencrypted private keys, compromising the security of the certificate signing process.
Which versions are affected by CVE-2024-23444?
CVE-2024-23444 affects Elasticsearch versions below 7.17.23 and between 8.0.0-alpha1 and 8.13.0.
Who discovered CVE-2024-23444?
CVE-2024-23444 was discovered by engineers at Elastic.