Vulnerability CVE-2020-28491 reported on Elasticsearch 7.17.4

Elastic Stack Elasticsearch
1

Hello,

vulnerability CVE-2020-28491 is reported on the jackson-dataformat-cbor-2.10.4.jar library of Elasticsearch (lib/jackson-dataformat-cbor-2.10.4.jar).

Are there any official statements regarding if this vulnerability does indeed apply to Elasticsearch 7.17.4, or any plan to upgrade jackson-dataformat-cbor to a version that does not have the vulnerability ?

If not, is there any way that I can help upgrading this dependency to a higher version ?

Thanks for your help on this.

2

Thank you for your report.

Elastic's security reporting guidelines are available at Security issues | Elastic.

Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to security@elastic.co.

We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.

3

I've sent an email, thank you @ikakavas.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.