{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0b887ea1-b9b3-515a-978e-428b9786bb1d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "elasticsearch",
      "purl": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1",
      "type": "library",
      "group": "org.elasticsearch",
      "bom-ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1",
      "version": "7.17.15-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "elasticsearch",
            "purl": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15",
            "type": "library",
            "group": "org.elasticsearch",
            "version": "7.17.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-3120",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a8c021d-8fa9-5f4f-8400-40547ece2cd8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3120 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2014-3120 affects Elasticsearch versions before 1.4.0.Beta1 where the insecure MVEL scripting engine was enabled by default, allowing arbitrary Java code execution via the \"source\" parameter to _search. The target version 7.17.15 is not affected because: (1) MVEL has been completely removed from the codebase, (2) only safe, sandboxed scripting languages exist (Painless, Mustache, Expression...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-6439",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0f659667-980e-5cd5-999b-c0db84a2bf95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-6439 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2014-6439 affects Elasticsearch before 1.4.0.Beta1. The vulnerability was fixed in September 2014 by disabling CORS by default (commit f9de8b65898). Version 7.17.15 (target) is 9 years newer and inherits this upstream fix. CORS is disabled by default in HttpTransportSettings.java:31, preventing the XSS attack vector. The vulnerable pattern is not present.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-1427",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d5de5879-dac5-5fa2-a4ea-4bed4900ff9e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-1427 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2015-3337",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b03da626-b3d7-50f1-ab3b-0cb159805f8b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3337 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2015-3337 is a directory traversal vulnerability in Elasticsearch's site plugin feature (/_plugin/ endpoints). The vulnerable code that served static files from plugin directories was completely removed from Elasticsearch in commit 3b78267c715 (January 2016) by upstream developer Ryan Ernst. Target version 7.17.15 (2023) does not contain any site plugin code or the vulnerable handlePluginSi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-4165",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1682459-210f-51b6-90b7-e104cf9bf3b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-4165 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2015-4165 affects Elasticsearch snapshot API before version 1.6.0, allowing authenticated users to write arbitrary snapshot metadata files to filesystem locations outside intended snapshot directories. The target version 7.17.15 is not affected because comprehensive path validation defenses were introduced by upstream Elasticsearch developers prior to version 1.6.0 and are present in this v...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-5531",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b8d9aca9-d13f-5071-aac8-8ccb3f23ce55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5531 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2015-5531 describes a directory traversal vulnerability in Elasticsearch's snapshot API that allowed reading arbitrary files. The target version 7.17.15 contains the upstream fix added in 2015 (commits dd41c68741a6 and d437135321587). The defense in PathUtils.get() normalizes both the repository root and user-provided path, then validates that the normalized path starts with the normalized ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-17244",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8a1cccbf-a9e2-5396-9a15-ec38dc6bcb38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-17244 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.17.15 is not affected by CVE-2018-17244. The vulnerability (concurrent authentication requests for the same username receiving mixed headers) was fixed in upstream Elasticsearch 6.4.3 (October 2018) via thread context preservation during asynchronous realm authentication. These fixes were already present in the upstream Elasticsearch 7.x lineage before TuxCare onboarded version ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-17247",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01d110eb-5e92-5f8f-99bd-5cf7eaa55485",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-17247 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2018-17247 (XXE in ML find_file_structure API) is NOT PRESENT in Elasticsearch 7.17.15. The vulnerable XML parser configuration was fixed by upstream Elasticsearch in commit 110c4fdd650 (2018-11-27, author: dave.roberts@elastic.co) which shipped in the upstream 7.17.15 release. Both DocumentBuilderFactory and XMLInputFactory are hardened with complete XXE protections: DOCTYPE declarations d...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-3824",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fe5b124e-05dc-5b34-a9ba-709a9dfbd8b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-3824 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2018-3824 is NOT present in Elasticsearch 7.17.15-tuxcare.1. The XSS vulnerability in X-Pack Machine Learning was fixed by upstream Elastic in commit 2aeff7713c66 (March 2018) by introducing lenient parsing for ML objects read from internal indices. This fix was already included in the upstream Elasticsearch 7.17.15 release that TuxCare onboarded. The target correctly uses LENIENT_PARSER wh...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-3831",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:16b053ef-e237-5c7a-bae0-72da6abdecf8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-3831 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. CVE-2018-3831 describes an information disclosure vulnerability where the Elasticsearch _cluster/settings API leaked sensitive configuration (passwords, tokens, usernames) because persistentSettings and transientSettings were returned without applying the settingsFilter. The target repository (Elasticsearch 7.17.15-tuxcare.1) is NOT AFFECTED because the upstream fix was already included in the Elasticsearch 7.17.15 release that TuxCare onboarded. The fix (commit 0f22dbb1cce by Jason Tedor, 2018-08-29) properly applies settingsFilter.filter() to both persistentSettings() and transientSettings() at lines 95-96 of RestClusterGetSettingsAction.java. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 6.0.0, < 6.4.1), NVD (>= 5.6.0, < 5.6.12; >= 6.0.0, < 6.4.1), cve.org (< 5.6.12; < 6.4.1), Snyk (>= 5.6.0, < 5.6.12; >= 6.0.0, < 6.4.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-7611",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c1b386e4-3a4f-5a56-b9ad-d49f1eb38e5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-7611 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. The target Elasticsearch 7.17.15 is not affected by CVE-2019-7611. The vulnerability was fixed in the upstream Elasticsearch codebase in February 2019 (commits #38294, #38296, #38388) and shipped in version 7.0.0-beta1. The fix ensures that ResizeRequestInterceptor and IndicesAliasesRequestInterceptor are always registered, even when DLS_FLS is disabled, preventing permission bypass on _shrink, _split, and _aliases endpoints. When TuxCare onboarded Elasticsearch 7.17.15, the fix was already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.6.15; >= 6.0.0, < 6.6.1), NVD (< 5.6.15; >= 6.0.0, < 6.6.1), cve.org (< 5.6.15; < 6.6.1), Snyk (< 5.6.15; >= 6.0.0, < 6.6.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-7614",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ae5ad2d4-279a-5437-ac34-29c147a7b5d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-7614 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Target version 7.17.15 is NOT affected by CVE-2019-7614. The vulnerability (race condition causing response header leakage between concurrent requests) was fixed by upstream Elasticsearch in commit cd2972239cf (PR #43729) which added ThreadContext preservation to AsyncIOProcessor. This fix was already present in the upstream 7.17.15 release that TuxCare onboarded (commit 35934bf5822). The vulne...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-7619",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:22988bd3-4a5d-55d4-b8d2-821117235211",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-7619 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2019-7619 (username disclosure via API Key authentication) is NOT present in Elasticsearch 7.17.15. The vulnerability affected versions 7.0.0-7.3.2 and was fixed in September 2019 by upstream commit 80064652f81 (Tim Vernum). The fix adds doc_type validation and changes authentication failures from terminate() to unsuccessful() to prevent username enumeration. This fix was already present in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7009",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:addc6ee5-2130-5b2a-bf65-49d6efb5f774",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7009 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. The CVE-2020-7009 privilege escalation vulnerability in API key creation is not present in Elasticsearch 7.17.15. The vulnerability affected versions 6.7.0-6.8.7 and 7.0.0-7.6.1. The fix was introduced by upstream Elastic in commit cde8725e3cab (March 2020) by Tim Vernum, which added validation to prevent API keys from creating derived child keys with privileges. This fix was already present in the upstream 7.17.15 release before TuxCare onboarding. The target code uses a refactored structure (ApiKeyGenerator class) but contains the identical security check: when authenticated via API_KEY, CreateApiKeyRequest must have explicit empty role descriptors. Both API key creation paths (TransportCreateApiKeyAction and TransportGrantApiKeyAction) use this protected code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.7.0, < 6.8.8; >= 7.0.0, < 7.6.2), NVD (>= 6.7.0, < 6.8.8; >= 7.0.0, < 7.6.2), cve.org (< 6.8.8; < 7.0.0; < 7.6.2; = 6.7.0), Snyk (>= 6.7.0, < 6.8.8; >= 7.0.0, < 7.6.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7014",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:85390306-09dd-5ba4-844b-4cd3190138df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7014 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7014 affects Elasticsearch versions up to 7.6.1. The target version 7.17.15 is significantly newer and includes the complete fix that was implemented in upstream Elasticsearch. The vulnerability involved privilege escalation when creating derived API keys and authentication tokens. The fix, present in the target code at ApiKeyGenerator.java lines 50-57, validates that derived API keys ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7019",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:74b7f2c1-f2f0-5029-9b9d-ce433384a584",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7019 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7019 fix is already present in the target. The vulnerability allowed field disclosure in scrolling searches with Field Level Security when a less-privileged user reused a scroll context from a more-privileged user's query. The upstream fix (commit e5dce5e8058e by albert.zaharovits@elastic.co) stores FLS permissions in scroll contexts and restores them on reuse. This fix was included in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7020",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3fc95d64-ed91-52f4-9e58-8d0da6f7915f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7020 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2020-7020 is not present in Elasticsearch 7.17.15-tuxcare.1. The vulnerability involved Document Level Security (DLS) and Field Level Security (FLS) permissions not being properly preserved during scroll search operations, allowing users to view documents they should not have access to. The fix (commit e5dce5e8058) was already included in the upstream Elasticsearch 7.17.15 release that TuxC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-7021",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:57fd2d48-8bfd-592b-a03c-488fcbcb6aaa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7021 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 The target Elasticsearch 7.17.15-tuxcare.1 is not affected by CVE-2020-7021. The vulnerability (information disclosure of sensitive data in audit logs when emit_request_body is enabled) has been fixed by the upstream vendor. The fix introduces a RestRequestFilter interface that allows REST handlers to declare which field names should be redacted before audit logging. This fix was present in ups...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22132",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9af89438-ace0-53c0-b625-f51c0edea735",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22132 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 The target Elasticsearch 7.17.15 is not affected by CVE-2021-22132. The vulnerability (improper storage of HTTP Authorization headers in the .tasks index during async search operations) was fixed by upstream Elastic in commit 996058c975e, which was already included in the upstream 7.17.15 release that TuxCare onboarded. The fix replaces direct header storage with ClientHelper.filterSecurityHead...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22134",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d0cd8762-64c2-55eb-860b-35afbe1492b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22134 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Target Elasticsearch 7.17.15 is not affected by CVE-2021-22134. The vulnerability allowed bypassing Document/Field Level Security (DLS/FLS) on realtime GET requests for recently-updated documents by reading directly from the translog without applying security wrappers. The upstream fix (commit fb67d36d50e, authored by yannick@welsch.lu on 2021-07-01) introduced TranslogDirectoryReader that ensu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22135",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a528cd21-0a3f-5832-bcce-fbc28fe057e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22135 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. Version 7.17.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-62ww-4p3p-7fhj (affected below 7.11.2), NVD (affected below 7.11.2), CVE record (affected below 7.11.2), Snyk (affected below 7.11.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22137",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:28c7a787-6d6a-5b7f-82ad-9a32acace06b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22137 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 The target (Elasticsearch 7.17.15) is NOT AFFECTED by CVE-2021-22137. The vulnerability was fixed in upstream Elasticsearch 7.11.2 via commit 09b2ad5e8ba (PR #69505), which made ShardSearchRequest.requestCache mutable and enabled security interceptors to disable caching for shard-level requests when DLS/FLS is active. This fix was already present in the upstream 7.17.15 release that TuxCare onb...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22144",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9b24b8ea-6fdd-5647-8aec-804030bb5da1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22144 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2021-22144 affects Elasticsearch versions before 7.13.3 and 6.8.17. The target version 7.17.15 already contains the upstream fix (commit 3bb551dfa004d48858d50e6f2c6ebb6665f99aea from July 1, 2021) that was shipped in the upstream release before TuxCare onboarded version 7.17.15. The fix adds two-phase circular reference validation to the Grok parser: first scanning all patterns for simple s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22147",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:110b8336-9d21-5130-886a-52a5abe77a70",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22147 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2021-22147 is NOT present in Elasticsearch 7.17.15. The vulnerability pattern (bypassing document/field-level security on searchable snapshots) was fixed by upstream commit 2b0cb5e28a2f on 2021-07-27, which ensures the security wrapper function is applied when creating searchers for searchable snapshot indices. This fix shipped in upstream Elasticsearch v7.15.0 and all subsequent 7.x versio...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23708",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fe593bc0-81fb-5923-86da-c12a28e0433c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23708 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. The upstream fix was released in 7.17.1, and version 7.17.15 is a later release of the same line. Advisories: GitHub GHSA-pgq6-ccqj-hpqr (fixed in 7.17.1), NVD (fixed in 7.17.1), CVE record (last affected 7.17.0), Snyk (fixed in 7.17.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-23710",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3f68e4a0-438d-579a-adf1-4058e3d49bee",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-23710 is a false positive for org.elasticsearch:elasticsearch 7.17.15-tuxcare.1."
      }
    },
    {
      "id": "CVE-2022-23712",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6f231c4f-5dba-519e-85b8-0f38837c39cf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-23712 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2022-23712 affects Elasticsearch 8.0.0-8.2.0 due to an infinite recursion bug in the requestWithoutFailedHeader method when handling multiple malformed HTTP headers. The vulnerable code does not exist in version 7.17.15. The method requestWithoutFailedHeader and the MediaTypeHeaderException class were introduced in commit 0bb64cbe1e3 (Nov 2020) and first appeared in v8.0.0-alpha1. Version 7...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-31417",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:83f0775c-0bf6-5b58-bfa9-f27a8dfbfaea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-31417 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 The target Elasticsearch 7.17.15-tuxcare.1 is NOT AFFECTED by CVE-2023-31417. The vulnerability involved audit log credential filtering being bypassed when using deprecated `_xpack/security` API endpoints (wrapped in DeprecationRestHandler). The fix (commit 9d448a0f951 \"Introduce FilterRestHandler\") was already present in the upstream Elasticsearch 7.17.15 release that TuxCare onboarded. The fi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-31418",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:23c8a725-780f-50a3-8705-28486ef40966",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-31418 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. CVE-2023-31418 is NOT present in Elasticsearch 7.17.15. The vulnerability, which allowed unauthenticated attackers to cause OutOfMemory errors via malformed HTTP requests, was fixed in the upstream Elasticsearch 7.17.15 release before TuxCare onboarded this version. The fix (Netty4HttpHeaderValidator) validates HTTP headers early before reading request bodies into memory, preventing malformed requests from exhausting memory. This upstream fix is present and active in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 7.17.13; >= 8.0.0, < 8.9.0), NVD (<= 7.17.12; >= 8.0.0, <= 8.8.2), cve.org (= 7.17.12; >= 8.0.0, < 8.8.2; >= 2.13.3, < 3.6.0), Snyk (< 7.17.13; >= 8.0.0, < 8.9.0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-31419",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8fd4acb2-3043-54e4-ab74-5178d3c82b47",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-31419 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 CVE-2023-31419 affects Elasticsearch's regex wildcard matching in the _search API, where specially crafted query strings with many consecutive wildcards (e.g., \"***...\") could cause stack overflow via unbounded recursion. The vulnerable code recursively processed each wildcard individually via simpleMatchWithNormalizedStrings(pattern.substring(1), str), leading to stack exhaustion with sufficie...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46673",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8c1ec4de-b650-5341-b636-ba2c18d88f6c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46673 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch, and is fixed in 7.17.15-tuxcare.2."
      }
    },
    {
      "id": "CVE-2023-49921",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f734d0f2-76cb-5ef5-932a-8fdd7a229ff8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-49921 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-12539",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6173fc64-6df6-5b5e-be51-55c4f2f0b77e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-12539 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23444",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cd9e27e1-6050-54cc-a10d-934f33904d5f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-23444 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23446",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa9beb3a-1c2e-57c2-b16f-98fcb26af0b5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23446 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23449",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ecd4adab-29a6-5203-9fe3-532d2e256943",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23449 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Target version 7.17.15 is NOT AFFECTED by CVE-2024-23449. The vulnerability only affects Elasticsearch >= 8.4.0 and < 8.11.1, where BouncyCastle dependencies were removed from the ingest-attachment plugin. Version 7.17.15 still includes BouncyCastle libraries (bcmail-jdk15on, bcprov-jdk15on, bcpkix-jdk15on version 1.64), which prevents the LinkageError from occurring when processing public-key-...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2024-23450",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e3d430d3-e1e9-59d3-8181-6bf0b45423c8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23450 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-23451",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dcc56cfa-f231-52b9-a8ee-0102b4bc525f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23451 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.17.15 is not affected by CVE-2024-23451. The vulnerability exists in the Remote Cluster Security feature with API key based security model (Beta), which was introduced in Elasticsearch 8.10.0. Version 7.17.15 predates this feature entirely and uses a different architecture (TLS certificate-based authentication) for cross-cluster operations. The vulnerable code paths, including I...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-37280",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5a56de31-cb7b-5103-a90f-596a8ce85643",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-37280 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.17.15 is NOT AFFECTED by CVE-2024-37280. The vulnerability requires the \"passthrough\" type field mapper, which was introduced in Elasticsearch 8.13.0 (February 2024). Version 7.17.15 predates this experimental feature entirely and cannot process passthrough field type mappings. Exhaustive code search confirms PassThroughObjectMapper.java does not exist in the target, and no rela...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-43709",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5e4562ba-aba9-56be-9e37-9099ca7e30ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-43709 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-52979",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:74494515-cb38-5ecc-99be-87133c064015",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-52979 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    },
    {
      "id": "CVE-2024-52981",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:493f4d23-347d-5e30-859c-ca42e0aaf9cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-52981 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1"
    }
  ]
}