{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ca098199-c79f-5554-8af2-57b6a3524249",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "elasticsearch",
      "purl": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2",
      "type": "library",
      "group": "org.elasticsearch",
      "bom-ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2",
      "version": "7.16.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "elasticsearch",
            "purl": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3",
            "type": "library",
            "group": "org.elasticsearch",
            "version": "7.16.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-3120",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a5496bc0-7173-5ecf-a505-c20035354f8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3120 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2014-3120 is not present in Elasticsearch 7.16.3. The vulnerability (dynamic scripting enabled by default allowing arbitrary MVEL code execution) was fixed by upstream Elasticsearch in version 1.4.0.Beta1 (April 2014). The target version 7.16.3 (December 2021) is 7+ years newer and includes multiple layers of protection: (1) MVEL scripting language was completely removed in June 2014, (2) t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-6439",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:44fc9c7e-b2a1-5d7a-8ee7-d5a925abe068",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-6439 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2014-6439 affected Elasticsearch versions before 1.4.0.Beta1 (2014) with an XSS vulnerability in CORS functionality. The target version 7.16.3-tuxcare.2 (released 2021) already contains the upstream fix from September 2014 (commit bd0eb32d9c3) that disabled CORS by default. This fix was authored by upstream Elasticsearch developer Alexander Reelsen (alexander@reelsen.net) and was already pr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-1427",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:248e5f01-53f8-5ad3-bd46-6b90bd4ede17",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-1427 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2015-3337",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1593541b-c413-521b-9dd3-02e78d3c9770",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3337 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2015-3337 is a directory traversal vulnerability in Elasticsearch's site plugin functionality, which allowed serving static content from plugins. This vulnerability affected versions before 1.4.5 and 1.5.x before 1.5.2. The target version 7.16.3 is NOT affected because the entire site plugin feature was completely removed from Elasticsearch in January 2016 (commit 3b78267c715) by upstream d...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-4165",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:58ab67de-5abe-554b-88b4-d7b5a1a7ff84",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-4165 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2015-4165 affects Elasticsearch before version 1.6.0, allowing remote authenticated users to write arbitrary snapshot metadata files to arbitrary filesystem locations. The target (Elasticsearch 7.16.3-tuxcare.2) contains the upstream fix introduced in May 2015 (commit dd41c687) that validates all repository paths against the path.repo configuration setting. The vulnerable code pattern (acce...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5531",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:45af3f43-b5c6-5e2c-83a4-efd450c842c6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5531 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2015-5531 is NOT present in Elasticsearch 7.16.3-tuxcare.2. This directory traversal vulnerability affected Elasticsearch versions before 1.6.1 (fixed in 2015). The current version 7.16.3 (released 2021) includes the upstream fix: snapshot names are validated by Strings.validFileName() which blocks path separator characters (/, \\) and other invalid filename characters, preventing directory ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-17244",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1b13f973-59cd-5246-9fa1-eedc8fc4fc9e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-17244 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2018-17244 is not present in the target. The vulnerability, which allowed request headers to be mixed between concurrent authentication requests for the same username, was fixed in upstream Elasticsearch 6.4.3 (October 2018) and was already present in Elasticsearch 7.16.3 when TuxCare onboarded it. The fix commits (1bb2a1502d7 and 6d99d7dafce) are in HEAD and predate the first TuxCare commi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-17247",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1c409df9-6fa2-52ff-b02c-f2db03d810cb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-17247 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2018-17247 (XXE in Machine Learning find_file_structure API) does not affect Elasticsearch 7.16.3-tuxcare.2. The vulnerability affected only versions 6.5.0 and 6.5.1. The upstream vendor fix was applied in November 2018 (commit 4f3efe53c623 by dave.roberts@elastic.co) and shipped in all subsequent releases. Version 7.16.3 (December 2021) contains complete XXE protections in both XmlTextStru...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-3824",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b760d77a-2df7-5372-abeb-16dc80ec70b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-3824 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 Target Elasticsearch 7.16.3 is not affected by CVE-2018-3824. The vulnerability (XSS via injection of malicious data into ML indices) was fixed in upstream commit 2aeff7713c66ca226af7371a140eb2f2437280c4 (March 2018) by introducing strict parsing for API-submitted ML objects, which rejects unknown fields that could contain XSS payloads. This fix was already present in the upstream Elasticsearch...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-3831",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38b77822-007d-5587-9159-0000d11fe0eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-3831 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. The target repository (Elasticsearch 7.16.3-tuxcare.2) is not affected by CVE-2018-3831. The vulnerability, which allowed sensitive configuration information (passwords, tokens, usernames) to leak through the _cluster/settings API, was fixed by upstream commit 0f22dbb1cce (PR #33247) authored by Jason Tedor on August 29, 2018. This fix was already present in the upstream Elasticsearch 7.16.3 release that TuxCare onboarded, meaning the vulnerable code pattern never existed in any TuxCare version of this release line. The current code properly applies settingsFilter.filter() to both persistent and transient settings before returning them via the API.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 6.0.0, < 6.4.1), NVD (>= 5.6.0, < 5.6.12; >= 6.0.0, < 6.4.1), cve.org (< 5.6.12; < 6.4.1), Snyk (>= 5.6.0, < 5.6.12; >= 6.0.0, < 6.4.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-7611",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:723c91d2-fc2d-518f-90ca-818e837df62e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-7611 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. The target Elasticsearch 7.16.3-tuxcare.2 is NOT vulnerable to CVE-2019-7611. The vulnerability allowed bypassing permission checks on _aliases, _shrink, and _split endpoints when DLS/FLS was disabled. The fix, which ensures ResizeRequestInterceptor and IndicesAliasesRequestInterceptor are always registered regardless of the DLS_FLS_ENABLED setting, was applied upstream in February 2019 (commit 0164acb0a7e by Tim Vernum from Elastic) and was already present in the upstream Elasticsearch 7.16.3 release that TuxCare onboarded in June 2026. The vulnerable code pattern (empty interceptors set when DLS_FLS disabled) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.6.15; >= 6.0.0, < 6.6.1), NVD (< 5.6.15; >= 6.0.0, < 6.6.1), cve.org (< 5.6.15; < 6.6.1), Snyk (< 5.6.15; >= 6.0.0, < 6.6.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-7614",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2bc1595c-847b-5610-88f7-268a8b709b30",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-7614 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.16.3-tuxcare.2 is NOT AFFECTED by CVE-2019-7614. The vulnerability (race condition causing response header leakage between concurrent requests) was fixed upstream in Elasticsearch 7.2.1 (July 2019) via PR #43729. The target version 7.16.3 (released December 2021) already contains the fix, which was included in the upstream release that TuxCare onboarded. The fix adds ThreadConte...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-7619",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5e879b9b-5fbc-51e3-8f63-67f7698d0fa4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-7619 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 The target Elasticsearch 7.16.3-tuxcare.2 is not affected by CVE-2019-7619 (username disclosure via API Key service). The vulnerability fix was shipped in the upstream Elasticsearch 7.16.3 release that TuxCare onboarded. The fix includes: (1) doc_type validation to ensure retrieved documents are API keys, not user documents, and (2) changing authentication failure responses from terminate to un...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7009",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8384bf89-a266-5672-b941-92f189912877",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7009 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. CVE-2020-7009 affects Elasticsearch versions 6.7.0-6.8.7 and 7.0.0-7.6.1, allowing API keys to create derived API keys with elevated privileges. The target repository (Elasticsearch 7.16.3) is NOT AFFECTED because the fix was already present in the upstream 7.16.3 release. The validation logic preventing privilege escalation via API key derivation exists at ApiKeyGenerator.java:50-57 and was introduced by upstream commit 7f21ade9240 (authored by yang.wang@elastic.co on 2020-03-17), which predates the TuxCare onboarding commit. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.7.0, < 6.8.8; >= 7.0.0, < 7.6.2), NVD (>= 6.7.0, < 6.8.8; >= 7.0.0, < 7.6.2), cve.org (< 6.8.8; < 7.0.0; < 7.6.2; = 6.7.0), Snyk (>= 6.7.0, < 6.8.8; >= 7.0.0, < 7.6.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7014",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bed56217-731d-5b8b-a604-3f6f8980966f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7014 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7014 is NOT present in Elasticsearch 7.16.3. The vulnerability affects versions 7.0.0-7.6.1 and involves privilege escalation where an attacker with API key and authentication token creation capabilities could generate tokens with elevated privileges. The fix was implemented upstream in commit 7f21ade9240 (March 2020) and included in Elasticsearch 7.7.0+. The target version 7.16.3 alre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7019",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec856aef-b080-5adb-91cb-a2961178fdcb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7019 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7019 describes a field disclosure vulnerability in Elasticsearch scroll searches with Field Level Security. The target repository (Elasticsearch 7.16.3-tuxcare.2) is NOT AFFECTED because the upstream vendor (Elastic) already fixed this vulnerability before the 7.16.3 release. The fix is present in the target code at SecuritySearchOperationListener.java and RBACEngine.java. Fix commit e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7020",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b9d7eb31-615a-5786-8c49-bb465927fae8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7020 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7020 is NOT present in Elasticsearch 7.16.3. The vulnerability, affecting scroll searches with DLS/FLS that failed to preserve security permissions across scroll operations, was fixed by Elastic in August 2020 (PR #60640, commits 011773c8c2a-8dbcd49dc71) for versions 6.8.13 and 7.9.2. The target version 7.16.3 (released December 2021) is significantly later than 7.9.2 and already conta...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7021",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dcce558e-41a4-5ba0-b1b8-06ee99c81923",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7021 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7021 is not present in Elasticsearch 7.16.3-tuxcare.2. The fix for this information disclosure vulnerability was already included in the upstream Elasticsearch 7.16.3 release. The RestRequestFilter interface has been moved to core and is implemented by all REST handlers that process sensitive data (passwords, tokens, API keys, SAML content). When audit logging with emit_request_body is...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22132",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c436339b-f54b-539b-baa7-7da9ea5d2eb6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22132 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2021-22132 does NOT affect Elasticsearch 7.16.3. The vulnerability (information disclosure via unfiltered HTTP headers stored in .tasks index) was fixed by upstream Elastic in commit 996058c975e (Dec 2020) and shipped in version 7.10.2. The target version 7.16.3 already contains this upstream fix, which filters headers via ClientHelper.filterSecurityHeaders() before storage, keeping only in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22134",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f20df2b7-e952-5b4e-a0bd-55066da8b795",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22134 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.16.3-tuxcare.2 is NOT AFFECTED by CVE-2021-22134. The vulnerability, which allowed Document/Field Level Security (DLS/FLS) bypass on recently updated documents not yet refreshed from translog, was fixed in upstream Elasticsearch before version 7.16.3 was released. The fix commit (fb67d36d50e, July 2021) is present in the target and was authored by an Elastic employee (yannick@we...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22135",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a738dbe1-8510-5fb4-954e-0710c3293c6d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22135 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2021-22135 affects Elasticsearch versions before 7.11.2, allowing suggester and profile APIs to bypass document-level security restrictions. The target (7.16.3-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream Elasticsearch 7.16.3 release. The vulnerability pattern (allowing suggester/profile execution when DLS is enabled) is not present in the target code.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22137",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:70bf5745-1c55-5c76-910b-56cc6f3bfd92",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22137 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 The target Elasticsearch 7.16.3-tuxcare.2 is NOT affected by CVE-2021-22137. The vulnerability was fixed by the upstream vendor (Elastic) in version 7.11.2/7.12.0, and this fix was already included in the upstream 7.16.3 release that TuxCare onboarded. The fix commit d94edbfba101f23f3c571b1cee904b34afa8ecc0 (authored by yang.wang@elastic.co) is present in HEAD and contains all required security...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22144",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:686498bb-d7d0-5524-96ec-2f82c4fb808b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22144 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2021-22144 describes an uncontrolled recursion vulnerability in Elasticsearch's Grok parser that could crash the node when processing malicious patterns with direct self-references (e.g., INT = %{INT}). The target version 7.16.3 is NOT affected because the fix was already present in the upstream Elasticsearch release. Commit 3bb551dfa004d48858d50e6f2c6ebb6665f99aea (authored by danhermann@u...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22147",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a2a81f0a-8b93-5344-893e-444642bc23a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22147 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 The target Elasticsearch 7.16.3-tuxcare.2 is not affected by CVE-2021-22147. The vulnerability (document and field level security not applied to searchable snapshots) was fixed by upstream Elastic before the 7.16.3 release. The fix changed ReadOnlyEngine.acquireSearcherSupplier() from passing Function.identity() to passing the wrapper parameter, ensuring security filters are applied. This fix w...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23708",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:897a2791-4967-5c09-adf1-61d7996947b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-23708 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2022-23710",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fe4b3fcd-5524-555f-ab32-b3d92bea4bc8",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-23710 is a false positive for org.elasticsearch:elasticsearch 7.16.3-tuxcare.2."
      }
    },
    {
      "id": "CVE-2022-23712",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:09073b60-e6e6-590a-8d23-a8a3a23da6e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23712 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2022-23712 affects Elasticsearch 8.0.0 through 8.2.0. The target version 7.16.3 predates the affected range and lacks the specific vulnerability pattern introduced in 8.x architecture. While 7.16.3 contains the general error-handling mechanism (ExceptionsHelper.maybeDieOnAnotherThread), the specific code path or condition that triggers the DoS in 8.0.0-8.2.0 is not present in 7.16.3. TuxCar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-31417",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:917fafbb-2464-5d0a-9b95-d1fe5d2d2238",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-31417 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2023-31418",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4e5f3deb-059c-5b02-a839-4b16fcf37839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-31418 is fixed in version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2023-31419",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2b9aae27-8180-5244-ab76-cb9bee6278f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-31419 is fixed in version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2023-46673",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d3278943-ba1a-5531-9f0a-dccb06b9c134",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-46673 is fixed in version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2023-49921",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5214b35b-e04e-5a15-8dd5-c718e3b9af9a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-49921 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-12539",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9c4e22fd-7352-5004-8d4b-5e0c37253d65",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-12539 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23444",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f920c069-4be7-521d-a688-af2ac0e69735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-23444 is fixed in version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23449",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:69a2759f-d8c8-5a78-a652-85e84e3bc3d5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23449 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the attachment plugin includes the Bouncy Castle libraries, so the missing-library condition that triggers the crash is absent. The dependencies are declared in plugins/ingest-attachment/build.gradle:44 and packaged by build-tools/src/main/java/org/elasticsearch/gradle/plugin/PluginBuildPlugin.java:243. Plugin JARs are loaded through the plugin classloader in server/src/main/java/org/elasticsearch/plugins/PluginsService.java:719.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2024-23450",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:605d9a3a-4d81-5fea-89dd-900790a7b442",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23450 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23451",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:45cdb198-5838-5883-b173-7e3e875b085e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23451 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2024-23451 affects the API key-based Remote Cluster Security (RCS) feature, which is a Beta feature introduced in Elasticsearch 8.10.0 and fixed in 8.13.0. The target version 7.16.3 does not have this feature. The vulnerability requires the RCS API key authentication model with the isCrossClusterAccess() authorization check, which does not exist in 7.16.3. The target uses the traditional Cr...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2024-37280",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2eeb2910-0b89-59dd-a404-cd1b07f9bb43",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-37280 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.16.3 is not affected by CVE-2024-37280. The vulnerability requires the PassThroughObjectMapper feature, which was introduced in Elasticsearch 8.13. Version 7.16.3 predates this feature by multiple major versions, making the stack overflow vulnerability impossible to trigger. The vulnerable recursive alias generation code (RootObjectMapper.getAliasMappers) does not exist in this ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-43709",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3066b30e-de3d-5036-a3a7-3a99d8572311",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-43709 is fixed in version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-52979",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f0ca1a6e-80a0-5b9a-a65d-094f0978f582",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-52979 is fixed in version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-52981",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e36302f7-1079-5048-ab16-d61cbbddb2f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-52981 affects version 7.16.3-tuxcare.2 of org.elasticsearch:elasticsearch."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.16.3-tuxcare.2"
    }
  ]
}