bin/elasticsearch.in.sh | 8 7 + 1 - 0 !
bin/plugin | 4 3 + 1 - 0 !
2 files changed, 10 insertions(+), 2 deletions(-)

 assemble classpath from .jar files in /usr/share/java

src/main/java/org/elasticsearch/common/compress/lzf/LZFCompressedStreamOutput.java | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 use lzf.util.chunkencoderfactory so we can build with compress-lzf
 1.0.1

src/main/resources/es-build.properties | 1 0 + 1 - 0 !
1 file changed, 1 deletion(-)

 do not set build hash

pom.xml | 15 15 + 0 - 0 !
1 file changed, 15 insertions(+)

 add lucene-sandbox in pom.xml

config/elasticsearch.yml | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 fix cve-2014-3120,
 elasticsearch: remote code execution flaw via dynamic scripting

src/main/java/org/elasticsearch/http/netty/NettyHttpChannel.java | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix cve-2014-6439 by disabling cors by default