Earlier quoted context omitted.
The notion of Open Distro for ES being "a fork" is, in my opinion and as of last I checked, overblown. Yes, they bundle a bunch of freely licensed stuff to make up for features that Elastic themselves have paywalled off (or sealed behind their free-to-use, but non-libre, custom license where they don't show/include sources either), but they rely on and effectively install the (hitherto) Apache-licensed upstream relea…
You should consider opening an issue on their github [0]? AWS, from what I know, takes security seriously, and given they themselves use OpenDistro internally, this should become a top priority for them. [0] https://github.com/opendistro-for-elasticsearch/opendistro-b...
https://github.com/opendistro-for-elasticsearch/opendistro-b...