Elasticsearch vulnerabilities

It has been brought to our attention that certain Engine Yard customer environments are being compromised via Elasticsearch vulnerabilities. These vulnerabilities are very simple to exploit so we urge customers that use affected versions of Elasticsearch to upgrade immediately.

If your environment(s) run an affected version it is recommended to recreate the applicable environment(s), as there is a very high possibility that they have already been compromised. For information on rebuilding your environment please see https://support.cloud.engineyard.com/entries/21016433-Rebuild-an-Environment or submit a ticket for further assistance.

The relevant CVEs and affected Elasticsearch versions are:

Affected versions: <1.4.3

Affected versions: <1.2

Our Elasticsearch cookbook has been updated to install version 1.4.4 and so can be utilised to install an unaffected version of Elasticsearch:


Please sign in to leave a comment.

Powered by Zendesk