# Vulnerable Java version bundled with 8.14.3 & 8.15 **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [August 13, 2024, 7:41pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861 "2024-08-13T19:41:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![dan\_walker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_walker/32/136762_2.png) [@dan\_walker](https://discuss.elastic.co/u/dan_walker)\ **Post date:** [August 13, 2024, 7:41pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/1 "2024-08-13T19:41:16Z")
Java 22.0.1 contains a HIGH vulnerability, as indicated by CVEs reported in July 2024. This version is/was bundled with ES 8.14.3. I was expecting a version patch to be included in the next ES release, but looking at the ES Java version information on GitHub for 8.15.0, it looks like Java version 22.0.1 is still being used in the project. Is there an intended remediation for this vulnerability or am I missing something in the repo? ---
**Author:** ![Kathleen\_DeRusso](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kathleen_derusso/32/132039_2.png) [@Kathleen\_DeRusso](https://discuss.elastic.co/u/Kathleen_DeRusso)\ **Post date:** [August 13, 2024, 7:53pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/2 "2024-08-13T19:53:25Z")
From #Elastic Search to #Elasticsearch ---
**Author:** ![Kathleen\_DeRusso](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kathleen_derusso/32/132039_2.png) [@Kathleen\_DeRusso](https://discuss.elastic.co/u/Kathleen_DeRusso)\ **Post date:** [August 13, 2024, 7:53pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/3 "2024-08-13T19:53:25Z")
Added #elastic-stack-security ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [August 13, 2024, 9:00pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/4 "2024-08-13T21:00:10Z")
Thank you for your report. Elastic's security reporting guidelines are available at [Security issues | Elastic](https://www.elastic.co/community/security). Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to [security@elastic.co](mailto:security@elastic.co). We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled. ---
**Author:** ![dan\_walker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_walker/32/136762_2.png) [@dan\_walker](https://discuss.elastic.co/u/dan_walker)\ **Post date:** [August 13, 2024, 9:29pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/5 "2024-08-13T21:29:14Z")
Sure, I went ahead and sent a copy of this issue to the security email. Can you recommend documentation to me for upgrading the JDK bundled with Elasticsearch? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 13, 2024, 9:37pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/6 "2024-08-13T21:37:02Z")
> [@dan\_walker](#): > > Can you recommend documentation to me for upgrading the JDK bundled with Elasticsearch? You do not upgrade the bundled JDK, you need to install a separated JDK and configure the `ES_JAVA_HOME` environment variable to use that JDK. This is mentioned [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html#jvm-version). ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [August 14, 2024, 5:58am UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/7 "2024-08-14T05:58:19Z")
Also as mentioned in those docs: > Security issues and bugs within the bundled JVM are treated as if they were within Elasticsearch itself. In particular, a vulnerability in a dependency (such as the bundled JVM) may require the use of particular features in the dependency, and often you'll find that Elasticsearch doesn't use the vulnerable feature so the security issue is automatically mitigated. In contrast, upgrading individual dependencies (such as the bundled JVM) carries some risk, since you're moving into an untested configuration. In recent versions there have been JVM bugs that have cause Elasticsearch to malfunction. ---
**Author:** ![dan\_walker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_walker/32/136762_2.png) [@dan\_walker](https://discuss.elastic.co/u/dan_walker)\ **Post date:** [August 14, 2024, 1:37pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/8 "2024-08-14T13:37:14Z")
If there was some sort of official response to the CVE discovery, that would be enough for an organization to consider the risk mitigated, I'd imagine. Otherwise, if it comes up in a vulnerability scan - it is difficult to prove to a client the software is secure. That being said, a patch release upgrade seems low-risk for breaking functionality, i.e. 22.0.2 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 11, 2024, 1:37pm UTC](https://discuss.elastic.co/t/vulnerable-java-version-bundled-with-8-14-3-8-15/364861/9 "2024-09-11T13:37:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.