Elastic · Elasticsearch
A memory disclosure flaw exists in the error reporting of Elasticsearch, affecting versions 7.10.0 through 7.13.3. The vulnerable component is the code path that generates error messages returned to queries. An attacker who can submit arbitrary queries to Elasticsearch can send a malformed query that causes an error response containing fragments of a previously used data buffer, which may expose sensitive information such as documents or authentication details. The attack requires only the ability to submit queries to the service, with no user interaction specified.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
Public exploit code (Metasploit) was available the same day.
2 related vulnerabilities in the same code over 4 years.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.elasticsearch.client:elasticsearch-rest-client.
Upgrade to 7.13.4 or later
Set the version to 7.13.4 or later in your pom.xml or build.gradle.
The first fix for CVE-2021-22145. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 7.10.0 up to 7.13.4 | 7.13.4 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.