CVE-2023-46674
Elasticsearch-hadoop Unsafe Deserialization
Summary
Elasticsearch-hadoop Unsafe Deserialization
Original description
The description as published by the source.
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
elasticsearch
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.17.11"},{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co