Bug 1222238 (CVE-2024-23449) - VUL-0: CVE-2024-23449: elasticsearch: uncaught exception leads to crash
Summary: VUL-0: CVE-2024-23449: elasticsearch: uncaught exception leads to crash
Status: RESOLVED FIXED
Alias: CVE-2024-23449
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/399616/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-23449:4.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-02 13:20 UTC by SMASH SMASH
Modified: 2024-04-02 13:21 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-02 13:20:01 UTC 
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23449
https://bugzilla.redhat.com/show_bug.cgi?id=2272190
https://www.cve.org/CVERecord?id=CVE-2024-23449
https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458
Comment 2 Gianluca Gabrielli 2024-04-02 13:21:29 UTC 
close as no products affected.