CVE-2024-23444: 
Java vulnerability analysis and mitigation

CVE-2024-23444 is a security vulnerability discovered by Elastic engineering affecting the elasticsearch-certutil CLI tool. When using the csr option to create new Certificate Signing Requests, the tool stores the generated private key on disk unencrypted, even when the --pass parameter is specified in the command invocation. The vulnerability affects Elasticsearch versions prior to 7.17.23 and 8.13.0 (Elastic Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Elastic assessed it at 4.9 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-311 (Missing Encryption of Sensitive Data) (NVD).

The vulnerability exposes sensitive cryptographic material (private keys) by storing them unencrypted on disk, potentially allowing unauthorized access to the private key material. This could compromise the security of the certificate infrastructure if an attacker gains access to the unencrypted private keys (Elastic Advisory).

The vulnerability has been fixed in Elasticsearch versions 7.17.23 and 8.13.0. Users are advised to upgrade to these or later versions to address the issue (Elastic Advisory).