Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Elasticsearch includes a version of tika-core with a security vulnerability #90360

Closed
sbrunot opened this issue Sep 26, 2022 · 2 comments
Closed

Elasticsearch includes a version of tika-core with a security vulnerability #90360

sbrunot opened this issue Sep 26, 2022 · 2 comments
Labels
>bug :Security/Security Security issues without another label Team:Security Meta label for security team

Comments

@sbrunot
Copy link

sbrunot commented Sep 26, 2022 •
edited

Elasticsearch Version

8.4.2

Installed Plugins

No response

Java Version

bundled

OS Version

Linux 3f1511ad194d 5.15.0-47-generic #51-Ubuntu SMP Thu Aug 11 07:51:15 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Problem Description

Elasticsearch 8.4.1 includes tika-core-2.4.0.jar (in module ingest-attachment), that has vulnerability CVE-2022-33879 reported against it (see https://nvd.nist.gov/vuln/detail/CVE-2022-33879)

Steps to Reproduce

Install Elasticsearch 8.4.1, list the content of directory modules/ingest-attachment

Logs (if relevant)

No response
@sbrunot sbrunot added >bug needs:triage Requires assignment of a team area label labels Sep 26, 2022
@ebadyano ebadyano added :Security/Security Security issues without another label Team:Security Meta label for security team and removed needs:triage Requires assignment of a team area label labels Sep 26, 2022
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

@ywangd
Copy link
Member

ywangd commented Sep 27, 2022

Thank you for your report.

Elastic's security reporting guidelines are available at https://www.elastic.co/community/security. Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to security@elastic.co

We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.

@ywangd ywangd closed this as completed Sep 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
>bug :Security/Security Security issues without another label Team:Security Meta label for security team
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@ywangd @sbrunot @ebadyano @elasticsearchmachine