GHSA-8wx3-324g-w4qq – org.opensearch.plugin:opensearch-security

Package

Manager: maven
Name: org.opensearch.plugin:opensearch-security
Vulnerable Version: >=0 <1.3.14.0 || >=2.0.0.0 <2.11.0.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS: N/A pctlN/A

Details

OpenSearch uncontrolled resource consumption ### Impact An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and corresponds to security advisory [ESA-2023-13](https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616) (CVE-2023-31418). ### Mitigation Versions 1.3.14 and 2.11.0 contain a fix for this issue. ### For more information If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.

Metadata

Created: 2023-10-17T14:24:48Z
Modified: 2023-10-17T14:24:48Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-8wx3-324g-w4qq/GHSA-8wx3-324g-w4qq.json
CWE IDs: ["CWE-400"]
Alternative ID: N/A
Finding: F002
Auto approve: 1