https://bugzilla.redhat.com/show_bug.cgi?id=1244238
Bug ID: 1244238
Summary: CVE-2015-5531 elasticsearch: directory traversal
attack
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bkabrda(a)redhat.com, bkearney(a)redhat.com,
bobjensen(a)gmail.com, cbillett(a)redhat.com,
cpelland(a)redhat.com, cperry(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jvanek(a)redhat.com, katello-bugs(a)redhat.com,
kseifried(a)redhat.com, mmccune(a)redhat.com,
ohadlevy(a)redhat.com, pbrobinson(a)gmail.com,
tjay(a)redhat.com, tomckay(a)redhat.com, zbyszek(a)in.waw.pl
It was reported that Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable
to a directory traversal attack.
Mitigation:
Constrain access to the snapshot API to trusted sources.
Statement:
This issue did not affecte versions of elasticsearch as shipped with Red Hat
Satellite 6 and Subscription Asset Manager 1.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=6qCGPbSGgj&a=cc_unsubscribe