GHSA-6g3j-p5g6-992f OpenSearch StackOverflow vulnerability
A specially crafted query in the OpenSearch _search API causes a Stack Overflow, leading to a Denial of Service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6g3j-p5g6-992f?
GHSA-6g3j-p5g6-992f is a denial of service vulnerability in org.opensearch:opensearch, published on 1 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
A flaw was discovered in OpenSearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 (CVE-2023-31419).
Mitigation
Versions 1.3.14 and 2.11.1 contain a fix for this issue.
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [email protected]. Please do not create a public GitHub issue.
Which versions are affected by GHSA-6g3j-p5g6-992f?
4 open source packages ship an affected version, including org.opensearch:opensearch.
| Package | Affected | Fixed in |
|---|---|---|
org.opensearch:opensearch Maven | All versions | 1.3.14 |
org.opensearch:opensearch Maven | All versions | 1.3.14 |
org.opensearch:opensearch Maven | From 2.0.0 | 2.11.1 |
org.opensearch:opensearch Maven | From 2.0.0 | 2.11.1 |
How do I fix GHSA-6g3j-p5g6-992f?
Upgrade org.opensearch:opensearch to a fixed version for your release line: 1.3.14 or 2.11.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-6g3j-p5g6-992f being exploited?
There is no known exploitation of GHSA-6g3j-p5g6-992f in the wild and no public exploit code.