CVE-2024-23444
Elasticsearch elasticsearch-certutil csr fails to encrypt private key
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Elasticsearch elasticsearch-certutil csr fails to encrypt private key
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
CVE-2024-23444- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
EUVDEUVD-2024-2271
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
EUVD-2024-2271- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5v8f-xx9m-wj44
Elasticsearch stores private key on disk unencrypted
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
GHSA-5v8f-xx9m-wj44- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
NVD
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
CVE-2024-23444- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
OSV
Elasticsearch elasticsearch-certutil csr fails to encrypt private key
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
CVE-2024-23444- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
OSVGHSA-5v8f-xx9m-wj44
Elasticsearch stores private key on disk unencrypted
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
GHSA-5v8f-xx9m-wj44- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-311
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-23444
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
UBUNTU-CVE-2024-23444- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-elasticsearch-2024-23444 No score
Elasticsearch elasticsearch-certutil csr fails to encrypt private key
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
- Record
BIT-elasticsearch-2024-23444- Updated
- 2026-11-02
OSVCLSA-2026-1783472555 No score
TuxCare security update for org.elasticsearch:elasticsearch (3 CVEs)
TuxCare rebuilt org.elasticsearch:elasticsearch to address 3 CVEs. Fixed in 7.16.3-tuxcare.1.
- Record
CLSA-2026-1783472555- Updated
- 2026-11-02
OSVCLSA-2026-1792654461 No score
TuxCare security update for org.elasticsearch:elasticsearch (3 CVEs)
TuxCare rebuilt org.elasticsearch:elasticsearch to address 3 CVEs. Fixed in 7.17.15-tuxcare.1.
- Record
CLSA-2026-1792654461- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
8.0.0-alpha1 up to 8.13.0 | 8.13.0 |
org.elasticsearch:elasticsearchMaven |
before 7.17.23 | 7.17.23 |
elasticsearchBitnami |
before 7.17.23, 8.0.0 up to 8.13.0 | 7.17.238.13.0 |
org.elasticsearch:elasticsearchTuxCare:Maven From an advisory covering 3 CVEs |
7.16.3 up to 7.16.3-tuxcare.1 | 7.16.3-tuxcare.1 |
org.elasticsearch:elasticsearchTuxCare:Maven From an advisory covering 3 CVEs |
7.17.15 up to 7.17.15-tuxcare.1 | 7.17.15-tuxcare.1 |
org.elasticsearch:elasticsearchMaven |
8.0.0-alpha1 up to 8.13.0, plus listed versions 8.0.08.0.0-alpha28.0.0-beta18.0.0-rc18.0.0-rc2 Show 45 moreShow less8.0.18.1.08.1.18.1.28.1.38.10.08.10.18.10.28.10.38.10.48.11.08.11.18.11.28.11.38.11.48.12.08.12.18.12.28.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.5.08.5.18.5.28.5.38.6.08.6.18.6.28.7.08.7.18.8.08.8.18.8.28.9.08.9.18.9.2 |
8.13.0 |
org.elasticsearch:elasticsearchMaven |
before 7.17.23, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 45 moreShow less0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4 |
7.17.23 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-23444 is a medium vulnerability (CVSS 4.9) in Elastic Elasticsearch, published July 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in org.elasticsearch:elasticsearch 8.13.0.
References
discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157
security.netapp.com/advisory/ntap-20250404-0001
nvd.nist.gov/vuln/detail/CVE-2024-23444
github.com/elastic/elasticsearch/pull/106105
Show 7 moreShow less
ubuntu.com/security/CVE-2024-23444
cve.org/CVERecord?id=CVE-2024-23444
Left out here: 287 versions. The JSON record has them.