On 30/08/14 5:37 AM, "Salvatore Bonaccorso" <car...@debian.org> wrote:
>Source: elasticsearch >Severity: grave >Tags: security upstream fixed-upstream > >Hi Hilko, > >I see elasticsearch entered unstable now. Some time ago the following >vulnerability was published for elasticsearch. > >CVE-2014-3120[0]: >| The default configuration in Elasticsearch before 1.2 enables dynamic >| scripting, which allows remote attackers to execute arbitrary MVEL >| expressions and Java code via the source parameter to _search. NOTE: >| this only violates the vendor's intended security policy if the user >| does not run Elasticsearch in its own independent virtual machine. > >If I understand it correctly, the value or this defaults to false, >more references are in Red Hat's Bugzilla[1]. Could you check >elasticsearch for this? Hi Salvatore. I've checked the current version in the archive and it definitely is vulnerable. I've made a patch and am just running some build tests now. I'm hoping that Hilko can make an upload as I'm not on the uploaders list, and don't really know how anyway. >If you fix the vulnerability please also make sure to include the >CVE (Common Vulnerabilities & Exposures) id in your changelog entry. Done. >For further information see: > >[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3120 > https://security-tracker.debian.org/tracker/CVE-2014-3120 >[1] https://bugzilla.redhat.com/show_bug.cgi?id=1124252 >[2] https://github.com/elasticsearch/elasticsearch/issues/5853 >[3] https://github.com/elasticsearch/elasticsearch/commit/81e83cca These were great resources - thanks for including them in the message. Tim Potter Cloud Systems Engineer HP Cloud Services timothy.pot...@hp.com M +61 419 749 832 Hewlett-Packard Australia Pty Ltd This e-mail may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorised to receive for the recipient), please contact the sender by reply e-mail and delete all copies of this message.
smime.p7s
Description: S/MIME cryptographic signature
__ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use debian-j...@lists.debian.org for discussions and questions.
