[java-sig-commits] [Bug 1230761] New: CVE-2015-4165 elasticsearch: unspecified arbitrary files modification vulnerability

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1230761

Bug ID: 1230761
           Summary: CVE-2015-4165 elasticsearch: unspecified arbitrary
                    files modification vulnerability
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: high
          Priority: high
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail], [e-mail]

All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that
uses Elasticsearch to modify files read and executed by certain other
applications.
Upstream bug/commit unknown at the time of writing.

Mitigation:
===========
Users should upgrade to 1.6.0. Alternately, ensure that other applications are
not present on the system, or that Elasticsearch cannot write into areas where
these applications would read.

External References:

https://www.elastic.co/community/security/