CVE-2024-23444CWE-311

Elasticsearch elasticsearch-certutil csr fails to encrypt private key

Medium · published July 31, 2024

CVSS v3.1
4.9
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2024-07-31T17:26Z
EPSS history
Timeline
  • 31 JUL 17:26Z
    Elasticsearch elasticsearch-certutil csr fails to encrypt private key
    cvelistv5