There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers
    to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
    (CVE-2015-1427)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote
    attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE:
    this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own
    independent virtual machine. (CVE-2014-3120)

The Elasticsearch application hosted on the remote web server is affected by a remote code execution vulnerability due to unspecified flaws in the Groovy script engine. A remote unauthenticated attacker, using a specially crafted request, can escape the sandbox and execute arbitrary Java code. A successful attack  could allow the user to gain a remote shell or manipulate files on the remote system.

The Elasticsearch application hosted on the remote web server is affected by a remote code execution vulnerability due to a failure to properly sanitize user-supplied input to the 'source' parameter of the '/_search' page. A remote, unauthenticated attacker can exploit this flaw to execute arbitrary Java code or manipulate files on the remote host.

An updated katello-configure package that fixes one security issue is now available for Red Hat Subscription Asset Manager.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The katello-configure package provides the katello-configure script, which configures the Katello installation, and the katello-upgrade script, which handles upgrades between versions.

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to _search. (CVE-2014-3120)

All Subscription Asset Manager users are advised to upgrade to this updated package. The update provides a script that modifies the elasticsearch.yml configuration file to disable dynamic scripting.
After updating, run the 'katello-configure' command. This will update the elasticsearch.yml configuration file and restart the elasticsearch service.

Elastic reports :

Vulnerability Summary: In Elasticsearch versions 1.1.x and prior, dynamic scripting is enabled by default. This could allow an attacker to execute OS commands.

Remediation Summary: Disable dynamic scripting.

Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is vulnerable to CVE-2014-3120. These binaries are used in Elasticsearch output specifically when using the node protocol. Since a node client joins the Elasticsearch cluster, the attackers could use scripts to execute commands on the host OS using the node client's URL endpoint.
With 1.4.3 release, we are packaging Logstash with Elasticsearch 1.5.2 binaries which by default disables the ability to run scripts. This also affects users who are using the configuration option embedded=>true in the Elasticsearch output which starts a local embedded Elasticsearch cluster. This is typically used in development environment and proof of concept deployments. Regardless of this vulnerability, we strongly recommend not using embedded in production.

Note that users of transport and http protocol are not vulnerable to this attack.

Elastic reports :

Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that were introduced in 1.3.0. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.

Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users that do not want to upgrade can address the vulnerability by setting script.groovy.sandbox.enabled to false in elasticsearch.yml and restarting the node.

ID	Name	Product	Family	Published	Updated	Severity
419827	SCA: security update for org.elasticsearch:elasticsearch (GHSA-w94p-6mhw-4qxw)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	critical
433575	SCA: security update for org.elasticsearch:elasticsearch (GHSA-mrfm-jxgf-2h6v)	Tenable Cloud Security	SCA Checks	8/19/2025	7/2/2026	high
433575	SCA: security update for org.elasticsearch:elasticsearch (GHSA-mrfm-jxgf-2h6v)	Tenable Self-Hosted Container Security	SCA Checks	8/19/2025	7/2/2026	high
419827	SCA: security update for org.elasticsearch:elasticsearch (GHSA-w94p-6mhw-4qxw)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	critical
81816	Elasticsearch Groovy Script RCE	Nessus	CGI abuses	3/13/2015	3/28/2022	high
76572	Elasticsearch 'source' Parameter RCE	Nessus	CGI abuses	7/17/2014	3/28/2022	medium
77661	RHEL 6 : katello-configure (RHSA-2014:1186)	Nessus	Red Hat Local Security Checks	9/12/2014	3/28/2022	medium
84411	FreeBSD : elasticsearch and logstash -- remote OS command execution via dynamic scripting (43ac9d42-1b9a-11e5-b43d-002590263bf5)	Nessus	FreeBSD Local Security Checks	6/26/2015	3/28/2022	medium
84409	FreeBSD : elasticsearch -- remote OS command execution via Groovy scripting engine (026759e0-1ba3-11e5-b43d-002590263bf5)	Nessus	FreeBSD Local Security Checks	6/26/2015	3/28/2022	high

Detections

Analytics

Plugins Search

critical

high

high

critical

high

medium

medium

medium

high