Attachment 159215 Details for Bug 201834 – security/vuxml for elasticsearch < 1.6.1

[patch] security/vuxml for elasticsearch < 1.6.1

elastic_vuxml.diff (text/plain), 2.43 KB, created by Jason Unovitch on 2015-07-25 15:10:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jason Unovitch

Created: 2015-07-25 15:10:58 UTC

Size: 2.43 KB

patch

obsolete

>Index: vuln.xml
>===================================================================
>--- vuln.xml	(revision 392885)
>+++ vuln.xml	(working copy)
>@@ -58,6 +58,67 @@
> 
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="ae8c09cb-32da-11e5-a4a5-002590263bf5">
>+ <topic>elasticsearch -- directory traversal attack via snapshot API</topic>
>+ <affects>
>+ <package>
>+	<name>elasticsearch</name>
>+	<range><ge>1.0.0</ge><lt>1.6.1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Elastic reports:
>+	<blockquote cite="https://www.elastic.co/community/security">
>+	 Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0
>+	 are vulnerable to a directory traversal attack.
>+	 Remediation Summary: Users should upgrade to 1.6.1 or later, or
>+	 constrain access to the snapshot API to trusted sources.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2015-5531</cvename>
>+ <freebsdpr>ports/201834</freebsdpr>
>+ <url>https://www.elastic.co/community/security</url>
>+ </references>
>+ <dates>
>+ <discovery>2015-07-16</discovery>
>+ <entry>2015-07-25</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="fb3668df-32d7-11e5-a4a5-002590263bf5">
>+ <topic>elasticsearch -- remote code execution via transport protocol</topic>
>+ <affects>
>+ <package>
>+	<name>elasticsearch</name>
>+	<range><lt>1.6.1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Elastic reports:
>+	<blockquote cite="https://www.elastic.co/community/security">
>+	 Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are
>+	 vulnerable to an attack that can result in remote code execution.
>+	 Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0.
>+	 Alternately, ensure that only trusted applications have access to
>+	 the transport protocol port.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2015-5377</cvename>
>+ <freebsdpr>ports/201834</freebsdpr>
>+ <url>https://www.elastic.co/community/security</url>
>+ </references>
>+ <dates>
>+ <discovery>2015-07-16</discovery>
>+ <entry>2015-07-25</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="9d732078-32c7-11e5-b263-00262d5ed8ee">
> <topic>chromium -- multiple vulnerabilities</topic>
> <affects>

Actions: View | Diff

Attachments on bug 201834: 159169 | 159215 | 159560 | 159561