Non-critical leaks /elasticsearch/conf/_search (FEB 2018 Vulnerability Assessment)

[hmitsch]

Source: Bug 1434962

Can we do something about the leaks in https://analytics.mozilla.community/elasticsearch/conf/_search ?

From @sanacl:

According to our developers, the data being shown there is produced only for debugging purposes and will be soon removed. [..] In any case, this data is only available if you are logged in.

[canasdiaz]

Hey @acs,
what is your recommendation here?

[acs]

This data is not used anymore. Is legacy stuff that must be removed. Could you open a ticket in GrimoireELK asking for the removal of the code that generates the "conf" index?

Thanks!

[hmitsch]

@acs I created the ticket. Hope it is in the correct Github repo.

-Henrik

[acs]

Yes @hmitsch is in the right one:

chaoss/grimoirelab-elk#221

Thank you very much!

[canasdiaz]

This is what it is being returned now:

{"statusCode":404,"error":"Not Found","message":"Not Found"}

So we are done here @hmitsch