CVE-2021-22144
Medium
Description
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Elasticsearch
PublishedJul 26, 2021
First seenJul 26, 2021
How to fix
Update
- elastic elasticsearch6.8.17, 7.13.3 or later
- org.elasticsearch:elasticsearch6.8.17, 7.13.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic elasticsearch | v < 6.8.17, 7.0.0 ≤ v < 7.13.3 | 6.8.17, 7.13.3 |
| oracle communications_cloud_native_core_automated_test_suite | 1.8.0 | — |
| org.elasticsearch:elasticsearchMaven | v < 6.8.17, 7.0.0-alpha1 ≤ v < 7.13.3 | 6.8.17, 7.13.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.