Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. org.opensearch.plugin/opensearch-security
  4. ›
  5. GMS-2023-3477

GMS-2023-3477: OpenSearch uncontrolled resource consumption

October 17, 2023

Impact

An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests.

The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-13 (CVE-2023-31418).

Mitigation

Versions 1.3.14 and 2.11.0 contain a fix for this issue.

For more information

If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

References

  • github.com/advisories/GHSA-8wx3-324g-w4qq
  • github.com/opensearch-project/security/security/advisories/GHSA-8wx3-324g-w4qq

Code Behaviors & Features

Detect and mitigate GMS-2023-3477 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.3.14.0, all versions starting from 2.0.0.0 before 2.11.0.0

Fixed versions

  • 1.3.14.0
  • 2.11.0.0

Solution

Upgrade to versions 1.3.14.0, 2.11.0.0 or above.

Source file

maven/org.opensearch.plugin/opensearch-security/GMS-2023-3477.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:08 +0000.