# High Vulnerabilities found in Elasticsearch docker image v7.17.9

**URL:** <https://discuss.elastic.co/t/high-vulnerabilities-found-in-elasticsearch-docker-image-v7-17-9/325976>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [February 20, 2023, 12:46pm UTC](https://discuss.elastic.co/t/high-vulnerabilities-found-in-elasticsearch-docker-image-v7-17-9/325976 "2023-02-20T12:46:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hexer338](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hexer338/32/47413_2.png) [@hexer338](https://discuss.elastic.co/u/hexer338)\
**Post date:** [February 20, 2023, 12:46pm UTC](https://discuss.elastic.co/t/high-vulnerabilities-found-in-elasticsearch-docker-image-v7-17-9/325976/1 "2023-02-20T12:46:42Z")

</div>

Hi Elastic Team,  
We used aquasec's trivy scan([Trivy](https://aquasecurity.github.io/trivy/v0.17.2/)) to do vuln. scan on elasticsearch docker image: [docker.elastic.co/elasticsearch/elasticsearch:7.17.9](https://docker.elastic.co/elasticsearch/elasticsearch)

We found 4 HIGH severity vulnerabilities below:  
CVE-2023-0286  
CVE-2021-37136  
CVE-2021-37137  
CVE-2021-40690

Can you triage this and provide any necessary remediations for above vulnerabilities.  
FYI we did not find any remediation steps on [Security issues | Elastic](https://www.elastic.co/community/security) page.

Here is the full scan report: [Vulnerability scan of Elasticsearch v7.17.9 docker image using Trivy · GitHub](https://gist.github.com/Hexer338/94bd48732cc37ce289f5929183361645)

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [February 20, 2023, 12:52pm UTC](https://discuss.elastic.co/t/high-vulnerabilities-found-in-elasticsearch-docker-image-v7-17-9/325976/2 "2023-02-20T12:52:12Z")

</div>

Hi @hexer338,

The [Security Issues page](https://www.elastic.co/community/security) you references provides a link to the bug bounty programme in the Responsible Vulnerability Disclosure section. Did you submit a report this issue there? If not I would recommend that's the best place to report your findings.

Thanks for raising these issues!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 20, 2023, 8:58pm UTC](https://discuss.elastic.co/t/high-vulnerabilities-found-in-elasticsearch-docker-image-v7-17-9/325976/3 "2023-02-20T20:58:46Z")

</div>

Also on that page;

> Users and customers may report any other potential security issues to [security@elastic.co](mailto:security@elastic.co).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2023, 8:59pm UTC](https://discuss.elastic.co/t/high-vulnerabilities-found-in-elasticsearch-docker-image-v7-17-9/325976/4 "2023-03-20T20:59:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.