{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a5b1b40-dc2a-5e7b-89ff-cc202dae763d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "elasticsearch", "purl": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1", "type": "library", "group": "org.elasticsearch", "bom-ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1", "version": "7.17.15-tuxcare.1", "pedigree": { "ancestors": [ { "name": "elasticsearch", "purl": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15", "type": "library", "group": "org.elasticsearch", "version": "7.17.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-3120", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:9a8c021d-8fa9-5f4f-8400-40547ece2cd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3120 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2014-6439", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:0f659667-980e-5cd5-999b-c0db84a2bf95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-6439 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2015-1427", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:d5de5879-dac5-5fa2-a4ea-4bed4900ff9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-1427 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2015-3337", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:b03da626-b3d7-50f1-ab3b-0cb159805f8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3337 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2015-4165", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:b1682459-210f-51b6-90b7-e104cf9bf3b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-4165 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2015-5531", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:b8d9aca9-d13f-5071-aac8-8ccb3f23ce55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5531 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2018-17244", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:8a1cccbf-a9e2-5396-9a15-ec38dc6bcb38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-17244 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2018-17247", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:01d110eb-5e92-5f8f-99bd-5cf7eaa55485", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-17247 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2018-3824", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:fe5b124e-05dc-5b34-a9ba-709a9dfbd8b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-3824 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2018-3831", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:16b053ef-e237-5c7a-bae0-72da6abdecf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-3831 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2019-7611", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:c1b386e4-3a4f-5a56-b9ad-d49f1eb38e5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-7611 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2019-7614", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ae5ad2d4-279a-5437-ac34-29c147a7b5d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-7614 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2019-7619", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:22988bd3-4a5d-55d4-b8d2-821117235211", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-7619 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2020-7009", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:addc6ee5-2130-5b2a-bf65-49d6efb5f774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7009 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2020-7014", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:85390306-09dd-5ba4-844b-4cd3190138df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7014 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2020-7019", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:74b7f2c1-f2f0-5029-9b9d-ce433384a584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7019 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2020-7020", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:3fc95d64-ed91-52f4-9e58-8d0da6f7915f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7020 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2020-7021", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:57fd2d48-8bfd-592b-a03c-488fcbcb6aaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-7021 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2021-22132", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:9af89438-ace0-53c0-b625-f51c0edea735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22132 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2021-22134", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:d0cd8762-64c2-55eb-860b-35afbe1492b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22134 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2021-22135", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:a528cd21-0a3f-5832-bcce-fbc28fe057e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22135 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2021-22137", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:28c7a787-6d6a-5b7f-82ad-9a32acace06b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22137 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2021-22144", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:9b24b8ea-6fdd-5647-8aec-804030bb5da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22144 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2021-22147", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:110b8336-9d21-5130-886a-52a5abe77a70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22147 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2022-23708", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:fe593bc0-81fb-5923-86da-c12a28e0433c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23708 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2022-23710", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:3f68e4a0-438d-579a-adf1-4058e3d49bee", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-23710 is a false positive for org.elasticsearch:elasticsearch 7.17.15-tuxcare.1." } }, { "id": "CVE-2022-23712", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:6f231c4f-5dba-519e-85b8-0f38837c39cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23712 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2023-31417", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:83f0775c-0bf6-5b58-bfa9-f27a8dfbfaea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31417 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2023-31418", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:23c8a725-780f-50a3-8705-28486ef40966", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31418 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2023-31419", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:8fd4acb2-3043-54e4-ab74-5178d3c82b47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31419 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2023-46673", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:8c1ec4de-b650-5341-b636-ba2c18d88f6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46673 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2023-49921", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:f734d0f2-76cb-5ef5-932a-8fdd7a229ff8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49921 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-12539", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:6173fc64-6df6-5b5e-be51-55c4f2f0b77e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-12539 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-23444", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:cd9e27e1-6050-54cc-a10d-934f33904d5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23444 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-23446", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:aa9beb3a-1c2e-57c2-b16f-98fcb26af0b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23446 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-23449", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ecd4adab-29a6-5203-9fe3-532d2e256943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23449 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-23450", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:e3d430d3-e1e9-59d3-8181-6bf0b45423c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23450 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-23451", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:dcc56cfa-f231-52b9-a8ee-0102b4bc525f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23451 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-37280", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:5a56de31-cb7b-5103-a90f-596a8ce85643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-37280 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-43709", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:5e4562ba-aba9-56be-9e37-9099ca7e30ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-43709 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-52979", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:74494515-cb38-5ecc-99be-87133c064015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52979 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-52980", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:2d445ce7-d6f9-5f15-8c29-d5ca1d4c1ad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52980 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2024-52981", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:493f4d23-347d-5e30-859c-ca42e0aaf9cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52981 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2025-37731", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:f08d2156-d976-592b-85d4-6f1588610852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-37731 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } }, { "id": "CVE-2025-68384", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:9baa67e4-7c36-5980-a321-1b3854fa169f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68384 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch. not_affected \u2014 Elasticsearch 7.17.15 does not contain the User Profile feature (ProfileService) that is affected by CVE-2025-68384. The vendor patches add size validation to ProfileService.updateProfileData(), which stores user profile labels and applicationData. This entire feature was introduced in Elasticsearch 8.2+ and is completely absent from the 7.x series. Exhaustive searches confirm no ProfileService...", "justification": "code_not_present" } }, { "id": "CVE-2025-68390", "affects": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:c04c4ead-7c75-50a8-b4a7-ab4690ed769a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-68390 affects version 7.17.15-tuxcare.1 of org.elasticsearch:elasticsearch." } } ], "dependencies": [ { "ref": "pkg:maven/org.elasticsearch/elasticsearch@7.17.15-tuxcare.1" } ] }