Elasticsearch 8.15.2: OpenJDK CVEs

[stephenb (Stephen Brown)]

Duplicate

Issue with OpenJDK Vulnerabilities (CVE-2024) in Elasticsearch 8.15.2

Hi, As part of the vulnerability assessment (VA) scan on our ELK servers, we identified that the OpenJDK version is affected by multiple vulnerabilities. We are using a self-managed cluster. We did upgrade the ELK stack from version 8.13.2 to 8.15.2, but the OpenJDK vulnerabilities still remain unresolved. Current Elasticsearch Version: 8.15.2 Path: /usr/share/elasticsearch/jdk/ Installed Bundled JDK Version: 22.0.1 The reported CVE IDs are: CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CV…