Elasticsearch V8.10.4 died with a "noClassDefFoundError"

Elastic Stack Elasticsearch
1

Hey folks,

I just setup a new ES node with V8.10.4 for indexing our nextcloud documents.

After about 3 millions of index docs created, the Nextcloud indexer sends a (encrypted) PDF which lets ES die poorly. :cold_face:

java.lang.NoClassDefFoundError: org/bouncycastle/cms/CMSException
	at java.lang.Class.getDeclaredConstructors0(Native Method) ~[?:?]
	at java.lang.Class.privateGetDeclaredConstructors(Class.java:3549) ~[?:?]
	at java.lang.Class.getConstructor0(Class.java:3754) ~[?:?]
	at java.lang.Class.getDeclaredConstructor(Class.java:2930) ~[?:?]
	at org.apache.pdfbox.pdmodel.encryption.SecurityHandlerFactory.newSecurityHandler(SecurityHandlerFactory.java:132) ~[?:?]
	at org.apache.pdfbox.pdmodel.encryption.SecurityHandlerFactory.newSecurityHandlerForFilter(SecurityHandlerFactory.java:116) ~[?:?]
	at org.apache.pdfbox.pdmodel.encryption.PDEncryption.<init>(PDEncryption.java:97) ~[?:?]
	at org.apache.pdfbox.pdfparser.COSParser.prepareDecryption(COSParser.java:2974) ~[?:?]
	at org.apache.pdfbox.pdfparser.COSParser.retrieveTrailer(COSParser.java:285) ~[?:?]
	at org.apache.pdfbox.pdfparser.PDFParser.initialParse(PDFParser.java:173) ~[?:?]
	at org.apache.pdfbox.pdfparser.PDFParser.parse(PDFParser.java:226) ~[?:?]
	at org.apache.pdfbox.pdmodel.PDDocument.load(PDDocument.java:1232) ~[?:?]
	at org.apache.pdfbox.pdmodel.PDDocument.load(PDDocument.java:1206) ~[?:?]
	at org.apache.tika.parser.pdf.PDFParser.getPDDocument(PDFParser.java:317) ~[?:?]
	at org.apache.tika.parser.pdf.PDFParser.parse(PDFParser.java:172) ~[?:?]
	at org.apache.tika.parser.CompositeParser.parse(CompositeParser.java:298) ~[?:?]
	at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:195) ~[?:?]
	at org.apache.tika.Tika.parseToString(Tika.java:525) ~[?:?]
	at org.elasticsearch.ingest.attachment.TikaImpl.lambda$parse$0(TikaImpl.java:97) ~[?:?]
	at java.security.AccessController.doPrivileged(AccessController.java:714) ~[?:?]
	at org.elasticsearch.ingest.attachment.TikaImpl.parse(TikaImpl.java:96) ~[?:?]
	at org.elasticsearch.ingest.attachment.AttachmentProcessor.execute(AttachmentProcessor.java:121) ~[?:?]
	at org.elasticsearch.ingest.CompoundProcessor.innerExecute(CompoundProcessor.java:163) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.ingest.CompoundProcessor.execute(CompoundProcessor.java:139) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.ingest.Pipeline.execute(Pipeline.java:112) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.ingest.IngestDocument.executePipeline(IngestDocument.java:853) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.ingest.IngestService.executePipeline(IngestService.java:951) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.ingest.IngestService.executePipelines(IngestService.java:827) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.ingest.IngestService$1.doRun(IngestService.java:721) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:33) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:983) ~[elasticsearch-8.10.4.jar:?]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26) ~[elasticsearch-8.10.4.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) ~[?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) ~[?:?]
	at java.lang.Thread.run(Thread.java:1583) ~[?:?]

I could isolate that suspicious document and let it index again on our current production node with ES 7.17.13 - and there is no moaning. ES still continues to do its work - as I would have expected from V8.10 also.

What could be the reasons?

Any help appreciated.
Frank

2

Hi @Franco901,

Thanks for flagging this issue. Since you see this issue in 8.10 and not 7.17.3 I'm wondering if a dependency is missing or changed. Do you mind raising a GitHub issue for this one? I think a developer might have insights on this one, and I can't see a similar issue raised against the repo.

3

Hi Carly,

thanks for pointing me to the place where (hopefully) a developer can fix my issue.

Best regards
Frank

4

Discussion has moved to Elasticsearch V8.10.4 dies with a “noClassDefFoundError” · Issue #101307 · elastic/elasticsearch · GitHub. It looks like this was caused by the intentional removal of bouncycastle at https://github.com/elastic/elasticsearch/pull/88031.

2 Likes
5

Thanks for the update @Keith_Massey!

6

Good news!

This morning I got new Version 8.11 from your RPM repo and installed it on a test node.
Throwing one of the evil encrypted PDFs into it, doesn't seem to bring to death - as previous ES 7.17 did.

Tnx a lot.

Best regards
Franco

1 Like
7

Glad to hear it worked for you!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.