Bug#759736: elasticsearch: CVE-2014-3120

2014-09-02 Thread Hilko Bengen
* Potter, Tim (Cloud Services): >>Thanks for helping out with this bug. If you could attach your patch >>(the debdiff tool can be helpful here) to the bug report, either Hilko >>or I (or any DD) can rebuild and upload. > > Attached. I didn't know about debdiff - what a great tool! Thank you. I

Bug#759736: elasticsearch: CVE-2014-3120

2014-09-01 Thread Potter, Tim (Cloud Services)
On 2/09/14 2:19 AM, "tony mancill" wrote: >>> CVE-2014-3120[0]: >>> | The default configuration in Elasticsearch before 1.2 enables dynamic >>> | scripting, which allows remote attackers to execute arbitrary MVEL >>> | expressions and Java code via the source parameter to _search. NOTE: >>> | th

Bug#759736: elasticsearch: CVE-2014-3120

2014-09-01 Thread tony mancill
On 09/01/2014 01:05 AM, Potter, Tim (Cloud Services) wrote: > On 30/08/14 5:37 AM, "Salvatore Bonaccorso" wrote: > >> Source: elasticsearch >> Severity: grave >> Tags: security upstream fixed-upstream >> >> Hi Hilko, >> >> I see elasticsearch entered unstable now. Some time ago the following >> v

Bug#759736: elasticsearch: CVE-2014-3120

2014-09-01 Thread Potter, Tim (Cloud Services)
On 30/08/14 5:37 AM, "Salvatore Bonaccorso" wrote: >Source: elasticsearch >Severity: grave >Tags: security upstream fixed-upstream > >Hi Hilko, > >I see elasticsearch entered unstable now. Some time ago the following >vulnerability was published for elasticsearch. > >CVE-2014-3120[0]: >| The defa

Bug#759736: elasticsearch: CVE-2014-3120

2014-08-29 Thread Salvatore Bonaccorso
Source: elasticsearch Severity: grave Tags: security upstream fixed-upstream Hi Hilko, I see elasticsearch entered unstable now. Some time ago the following vulnerability was published for elasticsearch. CVE-2014-3120[0]: | The default configuration in Elasticsearch before 1.2 enables dynamic |