# Disable Attachment Processor from ElasticSearch

**URL:** <https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401>\
**Category:** Elasticsearch\
**Created:** [June 13, 2024, 12:00pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401 "2024-06-13T12:00:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![akula.vamshee](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@akula.vamshee](https://discuss.elastic.co/u/akula.vamshee)\
**Post date:** [June 13, 2024, 12:00pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/1 "2024-06-13T12:00:55Z")

</div>

Our instance of SonarQube was flagged as having an out-of-date Elasticsearch version (8.11.0) that contains security vulnerabilities. We must upgrade the Elasticsearch version (8.11.0) to (8.11.1). Due to external factors related to internal automation software, we cannot upgrade the SonarQube version now. As per the community’s response, it is impossible to upgrade Elasticsearch alone.

Looking at the community URL, there is a suggestion to disable the attachment processor in ES.

> [@Elasticsearch 8.11.1 Security Update (ESA-2024-05)](https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458):
>
> Elasticsearch Uncaught Exception (ESA-2024-05) An uncaught exception in Elasticsearch \>= 8.4.0 and \< 8.11.1 occurs when an encrypted PDF is passed to an [attachment processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/attachment.html) through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files. Affected Versions: Affects versions \>= 8.4.0 and \< 8.11.1 Solutions and Mitigations: The issue is resolved in version 8.11.1. This req…

The SonarQube community confirmed that the SonarQube distribution doesn’t even include the Elasticsearch attachment processor module.

exclude ' **/modules/ingest-attachment/**'

The question is, how can we ensure that the attachment processor is not installed in ES within Sonarqube?

I tried to look into the /elasticsearch/bin/ and /elasticsearch/plugins/ folders but could not find anything related to them. I wanted to make sure how we can check and confirm if the attachment processor is disabled/not installed in ES within my SonarQube.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 13, 2024, 12:14pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/2 "2024-06-13T12:14:28Z")

</div>

It's part of the distribution and I don't think you can uninstall it. You should try to upgrade to 8.14.1. It's compatible.

---

<div class="post-metadata">

**Author:** ![akula.vamshee](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@akula.vamshee](https://discuss.elastic.co/u/akula.vamshee)\
**Post date:** [June 13, 2024, 12:34pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/3 "2024-06-13T12:34:08Z")

</div>

Do you mean the Elasticsearch Distribution?

This page says that if we cannot upgrade the ES, then disable attachment processor.

> [@Elasticsearch 8.11.1 Security Update (ESA-2024-05)](https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458):
>
> Elasticsearch Uncaught Exception (ESA-2024-05) An uncaught exception in Elasticsearch \>= 8.4.0 and \< 8.11.1 occurs when an encrypted PDF is passed to an [attachment processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/attachment.html) through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files. Affected Versions: Affects versions \>= 8.4.0 and \< 8.11.1 Solutions and Mitigations: The issue is resolved in version 8.11.1. This req…

Can you provide more details how we can achieve this using the original details in my post?

Let me know if you need more information.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 13, 2024, 12:36pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/4 "2024-06-13T12:36:51Z")

</div>

> [@akula.vamshee](#):
>
> This page says that if we cannot upgrade the ES, then disable attachment processor.

If you cannot updgrade Elasticsearch at the moment and want to mitigate this, you should remove the `attachment` processor from any ingest pipelines have it.

But the main question is, are you using the `attachment` processor? This is not used per default, to use it you would need to create an ingest pipeline and use this processor in that pipeline, if you do not have anything like this, then you are not using it.

---

<div class="post-metadata">

**Author:** ![akula.vamshee](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@akula.vamshee](https://discuss.elastic.co/u/akula.vamshee)\
**Post date:** [June 13, 2024, 1:02pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/5 "2024-06-13T13:02:44Z")

</div>

Thanks for the details.

To give you some context, we did not explicitly install Elasticsearch for our requirement nor did we manage the config for ES. We have installed SonarQube 10.3, which includes embedded version ES 8.11.0.

Our instance of SonarQube was flagged as having an out-of-date Elasticsearch version (8.11.0) that contains security vulnerabilities. We must upgrade the Elasticsearch version (8.11.0) to (8.11.1). Due to external factors related to internal automation software, we cannot upgrade the SonarQube version at this time.

Sonarqube has confirmed that we cannot upgrade embedded ES alone. ES configuration is managed by Sonarqube and SQ has confirmed that the SonarQube distribution doesn’t even include the Elasticsearch attachment processor module.

exclude ' **/modules/ingest-attachment/**'

So as per your previous post, in this case, the attachment processor in ES is disabled and not installed? If yes, how can I confirm that in my ES installation?

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 13, 2024, 1:21pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/6 "2024-06-13T13:21:52Z")

</div>

> So as per your previous post, in this case, the attachment processor in ES is disabled and not installed?

No. It's installed by default.

> If yes, how can I confirm that in my ES installation?

It's no and you can confirm that by reading the logs when the node starts. It shows all the built-in modules.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 14, 2024, 12:43pm UTC](https://discuss.elastic.co/t/disable-attachment-processor-from-elasticsearch/361401/8 "2024-06-14T12:43:06Z")

</div>

> [@akula.vamshee](#):
>
> ES configuration is managed by Sonarqube and SQ has confirmed that the SonarQube distribution doesn’t even include the Elasticsearch attachment processor module.

Not sure why they would say that, as mentioned this is installed per default, I'm not sure you can even remove it.

But as already mentioned as well, if you do not have any ingest pipeline using the `attachment` processor, then it is not being used.

It is not used per default for anything, the user needs to create an ingest pipeline with this processor.