UpHeron
All vulnerabilities

Servers and applications

CVE-2024-23444

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

Severity
High 7.5
Published
31 Jul 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.17.23, 8.13.0
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • From 7.0.0 before 7.17.23
  • From 8.0.0 before 8.13.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-23444
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-23444