While installing external package for elastic search getting vulnerability CVE-2023-44487
While installing external package for elastic search getting vulnerability CVE-2023-44487 which is of severity 1 CRITICAL. Although the solution mentioned there as " Upgrade package libnghttp2-14 to version 1.40.0-1ubuntu0.2 or above." and an upgrade is also planned. however would like to know if anyone faced similar issue while installing external package for elastic search 8.10.3 and how is it fixed. Any other additional steps to be taken regarding to docker image or anything else.
Pegasystems Inc.
GB
As of now, our certification covers version 8.10.3 exclusively.
Pega is not directly vulnerable to CVE-2023-44487. However, your application server may be. You should check with your application server vendor on this.
If you are using Apache Tomcat as your application server, per Apache's website, the following versions are fixed for this CVE-2023-44487:
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94 https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81 https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14