Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.opensearch:opensearch

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    OpenSearch StackOverflow vulnerability

    GHSA-6g3j-p5g6-992f

    Affected
    • Maven org.opensearch:opensearch < 1.3.14; >= 2.0.0, < 2.11.1
    Fixed in
    2.11.11.3.14· Vendor fix available
    Issue
    Impact A flaw was discovered in OpenSearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 (CVE-2023-31419). Mitigation Versions 1.3.14 and 2.11.1 contain a fix for this issue. For more information If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

    Recommended action: Upgrade to 2.11.1 or 1.3.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →