CVE-2023-46673: High severity elastic vulnerability
Elastic Elasticsearch is vulnerable to a denial of service, caused by improper handling of exceptional conditions. By sending a specially crafted request using the Simulate Pipeline API, a remote authenticated attacker could exploit this vulnerability to cause an Elasticsearch node to crash.
Other sources
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-46673?
CVE-2023-46673 is a vulnerability that allows malformed scripts used in the script processor of an Ingest Pipeline to crash an Elasticsearch node when calling the Simulate Pipeline API.
What software is affected by CVE-2023-46673?
Elasticsearch versions between 7.0.0 and 7.17.14, and versions between 8.0.0 and 8.10.3 are affected by CVE-2023-46673.
What is the severity of CVE-2023-46673?
CVE-2023-46673 has a severity rating of 6.5 (medium).
How can I fix CVE-2023-46673?
To fix CVE-2023-46673, update your Elasticsearch installation to version 7.17.14 or 8.10.3.
Where can I find more information about CVE-2023-46673?
You can find more information about CVE-2023-46673 at the following references: [Discuss Elastic Community](https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708), [Elastic Community Security](https://www.elastic.co/community/security), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-46673).