CVE-2015-3337

Отчет

This issue affects the versions of elasticsearch as shipped with Red Hat Satellite 6.x and Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Меры по смягчению последствий

Users that do not want to upgrade can address the vulnerability in several ways, but these options will break any site plugin:

• Set http.disable_sites to true in the elasticsearch.yml config file on any node with a site plugin, and restart the Elasticsearch node.
• Use a firewall or proxy to block HTTP requests to /_plugin.
• Uninstall all site plugins from all Elasticsearch nodes. For Satellite 6.x and Sam 1.x you can simply firewall elasticsearch to trusted users only (e.g. root, katello, foreman). For instructions on this please see: https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.0/html-single/Installation_Guide/index.html#sect-Red_Hat_Satellite-Installation_Guide-Red_Hat_Satellite_Installation-Configuring_Red_Hat_Satellite_Manually