VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Mar 29, 2024· Updated Aug 12, 2024

Elasticsearch Uncaught Exception

CVE-2024-23449

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.elasticsearch:elasticsearchMaven
>= 8.4.0, < 8.11.18.11.1

Affected products

1

Patches

2
f9bf18a71661

Improving tika PDF handling (#101486) (#101520)

https://github.com/elastic/elasticsearchKeith MasseyOct 30, 2023via ghsa
commit
4 files changed · +29 −1
  • docs/changelog/101486.yaml+5 −0 added
    @@ -0,0 +1,5 @@
+pr: 101486
+summary: Improving tika handling
+area: Ingest Node
+type: bug
+issues: []
  • modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/TikaImpl.java+9 −0 modified
    @@ -107,6 +107,15 @@ static String parse(final byte content[], final Metadata metadata, final int lim
             } else {
                 throw new AssertionError(cause);
             }
+        } catch (LinkageError e) {
+            if (e.getMessage().contains("bouncycastle")) {
+                /*
+                 * Elasticsearch does not ship with bouncycastle. It is only used for public-key-encrypted PDFs, which this module does
+                 * not support anyway.
+                 */
+                throw new RuntimeException("document is encrypted", e);
+            }
+            throw new RuntimeException(e);
         }
     }
  • modules/ingest-attachment/src/test/java/org/elasticsearch/ingest/attachment/AttachmentProcessorTests.java+15 −1 modified
    @@ -243,11 +243,25 @@ public void testVisioIsExcluded() throws Exception {
         assertThat(attachmentData.get("content_length"), is(0L));
     }
 
-    public void testEncryptedPdf() throws Exception {
+    public void testEncryptedWithPasswordPdf() throws Exception {
+        /*
+         * This tests that a PDF that has been encrypted with a password fails in the way expected
+         */
         ElasticsearchParseException e = expectThrows(ElasticsearchParseException.class, () -> parseDocument("encrypted.pdf", processor));
         assertThat(e.getDetailedMessage(), containsString("document is encrypted"));
     }
 
+    public void testEncryptedWithKeyPdf() throws Exception {
+        /*
+         * This tests that a PDF that has been encrypted with a public key fails in the way expected
+         */
+        ElasticsearchParseException e = expectThrows(
+            ElasticsearchParseException.class,
+            () -> parseDocument("encrypted-with-key.pdf", processor)
+        );
+        assertThat(e.getDetailedMessage(), containsString("document is encrypted"));
+    }
+
     public void testHtmlDocument() throws Exception {
         Map<String, Object> attachmentData = parseDocument("htmlWithEmptyDateMeta.html", processor);
  • modules/ingest-attachment/src/test/resources/org/elasticsearch/ingest/attachment/test/sample-files/encrypted-with-key.pdf+0 −0 added
a59180459a3c

Improving tika PDF handling (#101486)

https://github.com/elastic/elasticsearchKeith MasseyOct 30, 2023via ghsa
commit
4 files changed · +29 −1
  • docs/changelog/101486.yaml+5 −0 added
    @@ -0,0 +1,5 @@
+pr: 101486
+summary: Improving tika handling
+area: Ingest Node
+type: bug
+issues: []
  • modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/TikaImpl.java+9 −0 modified
    @@ -107,6 +107,15 @@ static String parse(final byte content[], final Metadata metadata, final int lim
             } else {
                 throw new AssertionError(cause);
             }
+        } catch (LinkageError e) {
+            if (e.getMessage().contains("bouncycastle")) {
+                /*
+                 * Elasticsearch does not ship with bouncycastle. It is only used for public-key-encrypted PDFs, which this module does
+                 * not support anyway.
+                 */
+                throw new RuntimeException("document is encrypted", e);
+            }
+            throw new RuntimeException(e);
         }
     }
  • modules/ingest-attachment/src/test/java/org/elasticsearch/ingest/attachment/AttachmentProcessorTests.java+15 −1 modified
    @@ -243,11 +243,25 @@ public void testVisioIsExcluded() throws Exception {
         assertThat(attachmentData.get("content_length"), is(0L));
     }
 
-    public void testEncryptedPdf() throws Exception {
+    public void testEncryptedWithPasswordPdf() throws Exception {
+        /*
+         * This tests that a PDF that has been encrypted with a password fails in the way expected
+         */
         ElasticsearchParseException e = expectThrows(ElasticsearchParseException.class, () -> parseDocument("encrypted.pdf", processor));
         assertThat(e.getDetailedMessage(), containsString("document is encrypted"));
     }
 
+    public void testEncryptedWithKeyPdf() throws Exception {
+        /*
+         * This tests that a PDF that has been encrypted with a public key fails in the way expected
+         */
+        ElasticsearchParseException e = expectThrows(
+            ElasticsearchParseException.class,
+            () -> parseDocument("encrypted-with-key.pdf", processor)
+        );
+        assertThat(e.getDetailedMessage(), containsString("document is encrypted"));
+    }
+
     public void testHtmlDocument() throws Exception {
         Map<String, Object> attachmentData = parseDocument("htmlWithEmptyDateMeta.html", processor);
  • modules/ingest-attachment/src/test/resources/org/elasticsearch/ingest/attachment/test/sample-files/encrypted-with-key.pdf+0 −0 added

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.