Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04d3gzLTMyNGctdzRxcc4AA2ga

OpenSearch uncontrolled resource consumption

Impact

An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.

The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-13 (CVE-2023-31418).

Mitigation

Versions 1.3.14 and 2.11.0 contain a fix for this issue.

For more information

If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [email protected]. Please do not create a public GitHub issue.

Permalink: https://github.com/advisories/GHSA-8wx3-324g-w4qq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04d3gzLTMyNGctdzRxcc4AA2ga
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-8wx3-324g-w4qq
References:

• https://github.com/opensearch-project/security/security/advisories/GHSA-8wx3-324g-w4qq
• https://github.com/advisories/GHSA-8wx3-324g-w4qq

Repository: https://github.com/opensearch-project/security
Blast Radius: 0.0

Affected Packages