{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bc50cd1b-fe40-5e78-9b40-7d55e7ebd6bb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "elasticsearch-core", "purl": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1", "type": "library", "group": "org.elasticsearch", "bom-ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1", "version": "7.17.15-tuxcare.1", "pedigree": { "ancestors": [ { "name": "elasticsearch-core", "purl": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15", "type": "library", "group": "org.elasticsearch", "version": "7.17.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-3120", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:12c55045-8964-542d-a415-969c0f67d766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3120 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2014-6439", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:531effdd-9bcd-53a4-a2ce-8288286ac494", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-6439 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2015-1427", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:bcd70129-ab0d-5590-ac0c-b807919d724b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-1427 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2015-3337", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:d196be0b-d50b-5b13-8426-6505803230d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3337 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2015-4165", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ca3558ae-c5e3-531d-936a-9e31b9a5a880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-4165 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2015-5531", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:97f67c7d-85d7-543c-92ba-014871431806", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5531 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2018-17244", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:1b99099f-6117-5b98-8011-93e98a2d000a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-17244 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2018-17247", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:116703b0-b9bd-56d3-a93d-3d423731a33d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-17247 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2018-3824", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ab3533ae-9584-544e-81a3-4219e90b440b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-3824 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2018-3831", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:cd24acd6-81d9-54fa-a685-319089f2556d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-3831 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2019-7611", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:c6e4ad94-830a-5a81-a020-0ab67d020aa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-7611 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2019-7614", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:05eb7b08-ea2f-5239-bdfd-b00b0d25f6b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-7614 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2019-7619", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:a982312f-b3ed-50d3-a6bf-464a8ca30f1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-7619 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2020-7009", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:9ff093d8-1dc4-5e07-87e0-433c6fb9be2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7009 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2020-7014", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:19f18acf-65b8-5130-a849-cbb3efb28cdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7014 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2020-7019", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:768a520f-7bba-571f-8e6d-352c957ccc9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7019 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2020-7020", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:84c64864-6148-59c6-baa0-ca0c694e7ad1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7020 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2020-7021", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:6c3e0dcb-5a1c-5752-9e1f-6fdd2bb37dd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7021 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22132", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:8f7e1e9e-1eac-57ad-ac17-0e3a8748bd2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22132 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22134", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:af290203-f675-5925-a3d6-651256814880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22134 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22135", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:cb74c73b-3f24-54d9-9005-29c74eaee975", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22135 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22137", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:852ede7b-3e0d-5e7b-b404-41206c469fd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22137 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22144", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:384f695f-513c-5e88-8a73-ce74a518bda3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22144 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22145", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:081c4ae1-1db8-5ddc-90b1-1e1030968e40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22145 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2021-22147", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:3b3b9f4b-98ae-5479-9dec-7a48d134f92d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22147 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2022-23708", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:3fb6b861-3a2a-50d0-b292-26665a38dc51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23708 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2022-23710", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:34f10e40-ef3e-5c60-9a42-1874623aeb1d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-23710 is a false positive for org.elasticsearch:elasticsearch-core 7.17.15-tuxcare.1." } }, { "id": "CVE-2022-23712", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:f6a22dce-0216-50b8-90ec-7c7c704d6d69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23712 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2023-31417", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:49047dd9-9405-5eea-9164-1ed786c7f8f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31417 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2023-31418", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:c94f14f3-e4b0-5865-a028-734ae12706d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31418 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2023-31419", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:744b8ff8-4431-5905-b0bd-94b678fadb61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31419 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2023-46673", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:81e43977-a62c-5aea-a294-412da71d035a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46673 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2023-49921", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:7808af20-3676-5ffc-8f6c-18f8c1722972", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49921 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-12539", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:f84b625a-d866-5a57-815c-06c1ca4fcfa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-12539 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-23444", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:53a9a360-7875-57ee-a26f-5672fb4af90f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23444 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-23446", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:7219d2db-11b0-573d-9bfe-c2537ff3f07f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23446 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-23449", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ca81fcf0-dc55-58ea-936f-6a094756ef7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23449 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-23450", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:89bae0a9-23c3-58f8-9fce-f21655e3dea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23450 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-23451", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:983383d7-f44f-58db-a11e-b9f1307f4e25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23451 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-37280", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:5fd84499-b83a-5509-9d52-db55106a87cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-37280 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-43709", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:6bc230f9-9ad1-5905-ba44-e56473fbb543", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-43709 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-52979", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:a655f0ea-437a-56ce-b026-0a9079e45c5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52979 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-52980", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:11398537-4873-50c5-b2b0-7a6fcb530ef5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52980 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2024-52981", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:fe6b8680-9fec-5795-acef-d0605d6c631a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52981 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2025-37727", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:5d3807e2-852e-5ffc-a109-4b560cb87ce9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-37727 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2025-37731", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:20fcdaab-df4d-55c5-8696-87a41d1afb21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-37731 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } }, { "id": "CVE-2025-68384", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:0eb07956-7739-53ff-bd75-396e09679238", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68384 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core. not_affected \u2014 Elasticsearch 7.17.15 does not contain the User Profile feature (ProfileService) that is affected by CVE-2025-68384. The vendor patches add size validation to ProfileService.updateProfileData(), which stores user profile labels and applicationData. This entire feature was introduced in Elasticsearch 8.2+ and is completely absent from the 7.x series. Exhaustive searches confirm no ProfileService...", "justification": "code_not_present" } }, { "id": "CVE-2025-68390", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:0b3d9324-ec3c-5f6a-9666-df95c0336fe1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-68390 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch-core." } } ], "dependencies": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch-core@7.17.15-tuxcare.1" } ] }