Resource exhaustion in Elastic Cloud Enterprise and Elasticsearch - CVE-2023-31418
Published: September 22, 2023
Vulnerability identifier: #VU81073
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-31418
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote non-authenticated attacker can send specially crafted HTTP requests to the application, cause an OutOfMemory error and perform a denial of service (DoS) attack.
Affected software
Elastic Cloud Enterprise
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Elasticsearch
watsonx.data
Watson CP4D Data Stores
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Elasticsearch
watsonx.data
Watson CP4D Data Stores
How to mitigate CVE-2023-31418
Install updates from vendor's website.
Elastic Cloud Enterprise - addressed in versions 2.13.4, 3.6.1
Elasticsearch - addressed in versions 7.17.13, 8.9.0
watsonx.data - update to 2.0.2
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.6, 5.0.0
Watson CP4D Data Stores - update to 5.0
Elasticsearch - addressed in versions 7.17.13, 8.9.0
watsonx.data - update to 2.0.2
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.6, 5.0.0
Watson CP4D Data Stores - update to 5.0
External References
Related Security Bulletins
- Remote denial of service in Elasticsearch and Elastic Cloud Enterprise
- Resource exhaustion in IBM Watson Assistant for IBM Cloud Pak for Data
- Resource exhaustion in IBM Watson CP4D Data Stores
- Multiple vulnerabilities in IBM watsonx.data
- Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak