Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. org.opencastproject/opencast-elasticsearch-impl
  4. ›
  5. CVE-2024-52797

CVE-2024-52797: Searching Opencast may cause a denial of service

November 20, 2024 (updated November 21, 2024)

First noticed in Opencast 13 and 14, Opencast’s Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11.4 and newer, Elasticsearch queries are retried a configurable number of times in the case of error to handle temporary losses of connection to Elasticsearch. These invalid queries would fail, causing the retry mechanism to begin requerying with the same syntactically invalid query immediately, in an infinite loop. This causes a massive increase in log size which can in some cases cause a denial of service due to disk exhaustion.

References

  • github.com/advisories/GHSA-jh6x-7xfg-9cq2
  • github.com/opencast/opencast
  • github.com/opencast/opencast/pull/5033
  • github.com/opencast/opencast/pull/5150
  • github.com/opencast/opencast/security/advisories/GHSA-jh6x-7xfg-9cq2
  • nvd.nist.gov/vuln/detail/CVE-2024-52797

Code Behaviors & Features

Detect and mitigate CVE-2024-52797 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 11.4 before 13.10, all versions starting from 14.0 before 14.3, all versions starting from 15.0 up to 16.6

Fixed versions

  • 13.10
  • 14.3

Solution

Upgrade to versions 13.10, 14.3 or above.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-770: Allocation of Resources Without Limits or Throttling

Source file

maven/org.opencastproject/opencast-elasticsearch-impl/CVE-2024-52797.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:20 +0000.