Bug 2293500 (CVE-2023-46674)

Summary:	CVE-2023-46674 elasticsearch-hadoop: unsafe deserialization of java objects
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jcantril
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	elasticsearch-hadoop 7.17.11, elasticsearch-hadoop 8.9.0	Doc Type:	---
Doc Text:	A flaw was found in elasticsearch-hadoop that allowed the unsafe deserialization of Java objects from Hadoop or spark configuration properties that could have been modified by authenticated users. Unsafe deserialization may impact integrity by allowing an attacker to modify unexpected objects or data assumed safe from modification.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2293501

Description Robb Gatica 2024-06-20 20:45:02 UTC

Elasticsearch-hadoop Unsafe Deserialization (ESA-2023-28)

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

Affected Versions:
Elasticsearch-hadoop versions on all versions before 7.17.11
Elasticsearch-hadoop versions on or after 8.0.0 and before 8.9.0

Solutions and Mitigations:
The issue is resolved in versions 7.17.11 and 8.9.0.

Reference:
https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663