{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:efea3c77-f381-5449-bb23-04f7bdf7226f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "elasticsearch-java", "purl": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1", "type": "library", "group": "co.elastic.clients", "bom-ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1", "version": "8.7.1-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-31417", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:e801efba-ad93-5d4c-8f04-f076e15c3228", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-31417 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2023-31417 describes a server-side audit logging vulnerability in Elasticsearch server where sensitive credentials are not filtered when logging requests to deprecated `/_xpack/security/*` API endpoints. This repository is the Elasticsearch Java Client library (co.elastic.clients) - a client library that sends HTTP requests TO Elasticsearch servers, not the server itself. The affected compo..." } }, { "id": "CVE-2023-31418", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:96d9ae53-7e9a-56bc-a937-811d0017f14d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-31418 affects version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java." } }, { "id": "CVE-2023-31419", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:7d0b18a2-b149-5f56-8bb0-b48496affde1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-31419 does not affect version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 Target is elasticsearch-java 8.7.1 (official Java CLIENT), TuxCare ELS-maintained. The three supplied patch URLs are ONE upstream change \u2014 \"Add buffered lookahead for Jackson\" (PR #489 = 3c47c81b, plus backports #490 = 9592a6c and #491 = dc7de95) \u2014 authored by upstream Elastic (sylvain@elastic.co) on 2023-01-18. [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2023-46673", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:322f9d71-ee36-595e-a801-8ff2d76d377f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46673 affects version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java." } }, { "id": "CVE-2023-46674", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:d8f509c8-e0f1-56d5-b74d-6bd771fe8c75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46674 does not affect version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 Version 8.7.1 of elasticsearch-java does not contain the vulnerable rest5-client module. The patch addresses CVE-2023-46674 by replacing Jackson with Jakarta JSON-P in the ElasticsearchNodesSniffer class within the rest5-client module, but this module does not exist in version 8.7.1. The rest5-client module was added in a later version of the elasticsearch-java client library.", "justification": "code_not_present" } }, { "id": "CVE-2023-49921", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:9589dc7b-0de2-58fa-ad97-333856fb9b88", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-49921 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2023-49921 describes a vulnerability in Elasticsearch SERVER's Watcher component where search query results are logged at DEBUG level, potentially exposing sensitive document contents. This repository is the Elasticsearch Java CLIENT library (co.elastic.clients:elasticsearch-java v8.7.1), which contains only auto-generated API stubs for making requests to the server. The vulnerable server-s..." } }, { "id": "CVE-2024-23444", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:9f47ff54-a9eb-5cb0-85b2-9e57b9f45aeb", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-23444 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2024-23444 is a false positive for this repository. The CVE concerns the elasticsearch-certutil CLI tool, which is part of the Elasticsearch server distribution. This repository is the Elasticsearch Java Client library (co.elastic.clients:elasticsearch-java), a client API library for communicating with Elasticsearch servers. Exhaustive search found no certutil code, no CSR generation functi..." } }, { "id": "CVE-2024-23449", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:e818e46c-0f6f-552e-aaa6-c8978a40e051", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-23449 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 Wrong-project match. This repository is the Elasticsearch Java Client (co.elastic.clients:elasticsearch-java), a client library for connecting to Elasticsearch servers. CVE-2024-23449 concerns server-side PDF parsing in Elasticsearch server's ingest nodes. The vulnerable component (Apache Tika PDF parsing in the attachment processor) exists only in the Elasticsearch server codebase (elastic/ela..." } }, { "id": "CVE-2024-23450", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:39d936de-7800-5ec6-a060-3d9e84dd11ae", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-23450 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2024-23450 concerns Elasticsearch server's ingest pipeline document processing functionality, which causes node crashes when processing documents through deeply nested pipelines. This repository is the Elasticsearch Java Client library (version 8.7.1), not the Elasticsearch server. The client only constructs pipeline definition DTOs and makes API calls to the server - it contains no ingest ..." } }, { "id": "CVE-2024-43709", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:bf8982fc-699c-5ce5-a96b-d22dedaadc09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-43709 does not affect version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 Version 8.7.1 is not affected by CVE-2024-43709. The vulnerable code (BufferedByteConsumer class in rest5_client module) does not exist in this version. Version 8.7.1 uses Apache HttpClient 4.x (rest_client) with BufferedHttpEntity, while the vulnerability exists only in Apache HttpClient 5.x (rest5_client) with BufferedByteConsumer, which was introduced in later versions of elasticsearch-java.", "justification": "code_not_present" } }, { "id": "CVE-2024-52979", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:6c2de869-576b-57b5-8079-255f149f4ede", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-52979 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2024-52979 is a false positive for this repository. The CVE affects the Elasticsearch SERVER (elastic/elasticsearch) where Mustache template evaluation occurs, not the Elasticsearch Java CLIENT (elastic/elasticsearch-java) which only constructs and sends HTTP requests. This client library contains no Mustache template evaluation code, has no Mustache library dependencies, and delegates all ..." } }, { "id": "CVE-2024-52980", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:04fbfb40-1bf2-562e-8597-82ea63b58164", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-52980 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2024-52980 is a false positive for this repository. The CVE affects Elasticsearch SERVER's PatternBank class (server-side pattern processing logic), but this repository is the Elasticsearch Java CLIENT library (co.elastic.clients:elasticsearch-java v8.7.1). The client library contains no pattern processing logic - only generated DTOs (Data Transfer Objects) that serialize pipeline configura..." } }, { "id": "CVE-2024-52981", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:aba4598c-c563-5028-8e99-983a3320c727", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-52981 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2024-52981 is a wrong-project match. The advisory concerns Elasticsearch server's WKT geometry parser, but this repository is the Elasticsearch Java Client\u2014a client SDK that serializes WKT strings as JSON for HTTP transmission. The client contains no WKT parsing logic, no GeometryCollection handling, and no recursive geometry processing code. The vulnerable server-side parsing code is absen..." } }, { "id": "CVE-2025-37727", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:753fa286-0c51-5c91-acdd-1dae9d95e0c6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-37727 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2025-37727 is a wrong-project match for this repository. [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]" } }, { "id": "CVE-2025-37731", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:35627fcd-014c-588a-87a0-651c6d94b749", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-37731 is a false positive for co.elastic.clients:elasticsearch-java 8.7.1-tuxcare.1. false_positive \u2014 CVE-2025-37731 is a false positive for this repository. The CVE concerns Elasticsearch PKI realm, a server-side authentication mechanism in the Elasticsearch server that validates client certificates. This repository is the Elasticsearch Java Client (elasticsearch-java v8.7.1), a client library for connecting to Elasticsearch servers. The client library contains no server-side authentication co..." } }, { "id": "CVE-2025-68384", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:8f314238-bab3-5d44-bbe3-76415154423f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68384 does not affect version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 Version 8.7.1 is not affected by CVE-2025-68384. The vulnerable component (BufferedByteConsumer in the rest5_client package) does not exist in this version. Version 8.7.1 uses Apache HttpClient 4.x with a completely different architecture, while the CVE addresses a flaw in HttpClient 5.x's BufferedByteConsumer class. The vendor's patches exclusively target the rest5_client package, which was in...", "justification": "code_not_present" } }, { "id": "CVE-2025-68390", "affects": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ], "bom-ref": "urn:uuid:a4d47429-d77a-5c3e-a007-77cf0ba702a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68390 does not affect version 8.7.1-tuxcare.1 of co.elastic.clients:elasticsearch-java. not_affected \u2014 Target version 8.7.1 (March 2023) is not affected by CVE-2025-68390. The vulnerability exists in the BufferedByteConsumer class within the rest5_client module (Apache HttpClient 5.x based), which was introduced after version 8.7.1. The target uses rest_client with Apache HttpClient 4.x and standard BufferedHttpEntity, a fundamentally different architecture that predates the vulnerable code by o...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/co.elastic.clients/elasticsearch-java@8.7.1-tuxcare.1" } ] }