CVE-2023-46674
Elasticsearch-hadoop Unsafe Deserialization
概要
Elasticsearch-hadoop Unsafe Deserialization
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
elasticsearch
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.17.11"},{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]
参照URL
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co