Bug#759736: elasticsearch: CVE-2014-3120

2014-09-02 Thread Hilko Bengen
* Potter, Tim (Cloud Services): Thanks for helping out with this bug. If you could attach your patch (the debdiff tool can be helpful here) to the bug report, either Hilko or I (or any DD) can rebuild and upload. Attached. I didn't know about debdiff - what a great tool! Thank you. I am

Bug#759736: elasticsearch: CVE-2014-3120

2014-09-01 Thread Potter, Tim (Cloud Services)
On 30/08/14 5:37 AM, Salvatore Bonaccorso car...@debian.org wrote: Source: elasticsearch Severity: grave Tags: security upstream fixed-upstream Hi Hilko, I see elasticsearch entered unstable now. Some time ago the following vulnerability was published for elasticsearch. CVE-2014-3120[0]: | The

Bug#759736: elasticsearch: CVE-2014-3120

2014-09-01 Thread tony mancill
On 09/01/2014 01:05 AM, Potter, Tim (Cloud Services) wrote: On 30/08/14 5:37 AM, Salvatore Bonaccorso car...@debian.org wrote: Source: elasticsearch Severity: grave Tags: security upstream fixed-upstream Hi Hilko, I see elasticsearch entered unstable now. Some time ago the following

Bug#759736: elasticsearch: CVE-2014-3120

2014-09-01 Thread Potter, Tim (Cloud Services)
On 2/09/14 2:19 AM, tony mancill tmanc...@debian.org wrote: CVE-2014-3120[0]: | The default configuration in Elasticsearch before 1.2 enables dynamic | scripting, which allows remote attackers to execute arbitrary MVEL | expressions and Java code via the source parameter to _search. NOTE: |

Bug#759736: elasticsearch: CVE-2014-3120

2014-08-29 Thread Salvatore Bonaccorso
Source: elasticsearch Severity: grave Tags: security upstream fixed-upstream Hi Hilko, I see elasticsearch entered unstable now. Some time ago the following vulnerability was published for elasticsearch. CVE-2014-3120[0]: | The default configuration in Elasticsearch before 1.2 enables dynamic |