The Big Data Service installer deploys Elasticsearch with a cut-down, isolated Java Runtime Engine (JRE). The Windows service is configured to use this bundled JRE exclusively rather than a system-wide Java installation, making the deployment self-contained.

The benefits of a self-contained deployment are:

• straightforward installation with no Java prerequisite;
• no risk of version mismatch between Java and Elasticsearch.

However, the bundled JRE is an outdated release and may be flagged by vulnerability scanners.

An outdated version designation means the installed JRE is behind the vendor's current release, and therefore does not include security patches that have already been published. Vulnerability scanners flag outdated components because the gap between the installed version and the current release represents a set of documented vulnerabilities.

The scope of the risk is narrowed by the isolated nature of the deployment:

• The bundled JRE is invoked solely by the Intelligent Plant Big Data Service process. It is not a system-wide installation and is not accessible to other applications on the host.
• The Big Data Service exposes a local REST interface on port 9200. In a standard installation this interface is only accessible to local processes and is not reachable from the network.
• JVM-level vulnerabilities typically require an attacker to submit crafted content that the application processes and passes to the runtime. In an isolated, internally-facing deployment, the opportunity to deliver such content is significantly limited.

The affected server is additionally protected by:

• internal-only deployment;
• isolated network;
• no direct Internet exposure;
• access restricted to trusted internal systems;
• Windows operating system security controls;
• restricted administrative access.

Consequently, the practical risk presented by the JRE is considered low in the context of this deployment, despite the finding being correctly reported by vulnerability scanners.

Two remediation options are available:

• Interim: Upgrade the bundled JRE to the latest Long Term Support release of Java 8. This addresses the outdated finding without requiring a full product upgrade.
• Long-term: Migrate to the forthcoming major release of the Big Data Service, which will ship with a current Elasticsearch version and JRE. See Upcoming Release for release timeline information.

Refer to Upgrade Java Runtime Engine for full step-by-step instructions, prerequisites, and rollback procedure.

The JRE bundled with the Big Data Service is correctly identified by vulnerability scanners. However, within the context of an isolated, internally-facing deployment protected by appropriate network and access controls, the practical risk is considered low.

Upgrading the JRE to the latest Long Term Support release of Java 8 provides an effective interim mitigation with minimal operational impact. A full remediation will be delivered as part of the forthcoming product upgrade.