CVE-2023-46674

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-46674
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46674.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-46674
Aliases
Published
2023-12-05T18:15:12.380Z
Modified
2026-04-09T09:46:47.784649Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eeedb98c60326ea3d46caef960fb4c77958fb885
Introduced
1b6a7ece17463df5ff54a3e1302d825889aa1161
Fixed
8aa461beb06aa0417a231c345a1b8c38fb498a0d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.17.11"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.9.0"
        }
    ]
}

Affected versions

v7.*
v7.0.0-alpha1
v7.0.0-alpha2
v7.16.0
v7.16.1
v7.17.0
v7.17.1
v7.17.10
v7.17.2
v7.17.3
v7.17.4
v7.17.5
v7.17.6
v7.17.7
v7.17.8
v7.17.9
v8.*
v8.0.0-alpha1
v8.0.0-alpha2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46674.json"