# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=11 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 12 --- ## [Elastic Stack 6.8.7 and 7.6.1 security update](https://discuss.elastic.co/t/elastic-stack-6-8-7-and-7-6-1-security-update/222136)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 6:01pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-7-and-7-6-1-security-update/222136 "2020-03-04T18:01:20Z")
Kibana Node.js security flaws (ESA-2020-01) The version of Node.js shipped in all versions of Kibana prior to 7.6.1 and 6.8.7 contain three security flaws. CVE-2019-15604 describes a Denial of Service (DoS) flaw in the… --- ## [Elastic Stack 6.8.6 and 7.5.1 security update](https://discuss.elastic.co/t/elastic-stack-6-8-6-and-7-5-1-security-update/212390)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [December 18, 2019, 7:15pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-6-and-7-5-1-security-update/212390 "2019-12-18T19:15:47Z")
Kibana XSS (ESA-2019-17) Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizat… --- ## [Elastic Stack 7.5.0 security update](https://discuss.elastic.co/t/elastic-stack-7-5-0-security-update/210217)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [December 2, 2019, 4:39pm UTC](https://discuss.elastic.co/t/elastic-stack-7-5-0-security-update/210217 "2019-12-02T16:39:13Z")
Metricbeat and Filebeat DSA public key panic (ESA-2019-15) A denial of service flaw when parsing malformed DSA public keys was discovered in Go, the language used to implement Beats. If Metricbeat or Filebeat are config… --- ## [Elastic Stack 7.4.1 security update](https://discuss.elastic.co/t/elastic-stack-7-4-1-security-update/204909)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 4:07pm UTC](https://discuss.elastic.co/t/elastic-stack-7-4-1-security-update/204909 "2019-10-23T16:07:14Z")
Logstash Beats input denial of service flaw (ESA-2019-14) A denial of service flaw was found in the Logstash beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could … --- ## [Elastic Stack 7.4.0 security update](https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [October 1, 2019, 3:03pm UTC](https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831 "2019-10-01T15:03:11Z")
Elastic Code local file disclosure flaw (ESA-2019-12) A local file disclosure flaw was found in Elastic Code. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local fi… --- ## [Elastic Stack 6.8.4 security update](https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 4:02pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908 "2019-10-23T16:02:28Z")
Elasticsearch username disclosure flaw (ESA-2019-13) A username disclosure flaw was found in Elasticsearch’s API Key service. An unauthenticated attacker could send a specially crafted request and determine if a usernam… --- ## [Elastic APM agent for Python 5.1.0 security update](https://discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 3:19pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145 "2019-08-21T15:19:54Z")
Elastic APM agent for Python client CGI proxy redirection flaw (ESA-2019-11) When the Elastic APM agent for Python is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy h… --- ## [Elastic Stack 6.8.2 and 7.2.1 security update](https://discuss.elastic.co/t/elastic-stack-6-8-2-and-7-2-1-security-update/192963)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [July 30, 2019, 6:15pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-2-and-7-2-1-security-update/192963 "2019-07-30T18:15:54Z")
Elasticsearch race condition flaw (ESA-2019-07) A race condition flaw was found in the response headers Elasticsearch returns to a request. On a system with multiple users submitting requests, it could be possible for a… --- ## [Elastic APM agent for Ruby 2.9.0 security update](https://discuss.elastic.co/t/elastic-apm-agent-for-ruby-2-9-0-security-update/192960)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [July 30, 2019, 6:11pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-for-ruby-2-9-0-security-update/192960 "2019-07-30T18:11:36Z")
Elastic APM agent for Ruby client authentication flaw (ESA-2019-08) A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via th… --- ## [Elastic Stack 6.6.2 and 5.6.16 security update](https://discuss.elastic.co/t/elastic-stack-6-6-2-and-5-6-16-security-update/173180)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [March 20, 2019, 3:09pm UTC](https://discuss.elastic.co/t/elastic-stack-6-6-2-and-5-6-16-security-update/173180 "2019-03-20T15:09:22Z")
Winlogbeat insufficient logging issue (ESA-2019-06) Nate Guagenti (@ neu5ron), solutions engineer with Perched Inc. reported an issue in Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An a… --- ## [Elastic Stack 6.6.1 and 5.6.15 security update](https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [February 19, 2019, 5:09pm UTC](https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 "2019-02-19T17:09:47Z")
Kibana XSS issue (ESA-2019-01) Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on b… --- ## [Elastic Stack 6.5.2 security update](https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [December 5, 2018, 7:42pm UTC](https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594 "2018-12-05T19:42:41Z")
Elasticsearch information disclosure (ESA-2018-19) Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning’s find\_file\_structure API. If a policy allowing external network access has been… --- ## [Elastic Stack 6.4.3 and 5.6.13 security update](https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [November 6, 2018, 6:35pm UTC](https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594 "2018-11-06T18:35:11Z")
Elasticsearch information disclosure (ESA-2018-16) Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or Fil… --- ## [Elastic Stack 6.4.1 and 5.6.12 security update](https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [September 19, 2018, 1:18am UTC](https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 "2018-09-19T01:18:59Z")
Kibana XSS issue (ESA-2018-14) Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform de… --- ## [Elastic Cloud Enterprise 1.1.4 security update](https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778)
**Author:** [@Maurits\_Fennis](https://discuss.elastic.co/u/Maurits_Fennis)\ **Replies:** 0\ **Last updated:** [June 13, 2018, 6:28pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778 "2018-06-13T18:28:07Z")
Elastic Cloud Enterprise use of shared encryption key (ESA-2018-09) In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasti… --- ## [Elastic Stack 6.3.0 and 5.6.10 Security Update](https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777)
**Author:** [@Maurits\_Fennis](https://discuss.elastic.co/u/Maurits_Fennis)\ **Replies:** 0\ **Last updated:** [June 13, 2018, 6:23pm UTC](https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777 "2018-06-13T18:23:18Z")
Elasticsearch Information Exposure Vulnerability (ESA-2018-10) In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the \_snapshot API. When the access\_key and security\_key parameters are set usi… --- ## [Elastic Stack 6.2.4 and 5.6.9 security update](https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [April 17, 2018, 7:18pm UTC](https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422 "2018-04-17T19:18:54Z")
X-Pack Machine Learning XSS vulnerability (ESA-2018-06) X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage\_ml permissions could create jobs contain… --- ## [Elastic Stack 6.2.3 security update](https://discuss.elastic.co/t/elastic-stack-6-2-3-security-update/124848)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [March 20, 2018, 7:30pm UTC](https://discuss.elastic.co/t/elastic-stack-6-2-3-security-update/124848 "2018-03-20T19:30:16Z")
X-Pack Security SAML vulnerability (ESA-2018-07) X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might hav… --- ## [Elastic Stack 6.1.3 and 5.6.7 security update](https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 6:21pm UTC](https://discuss.elastic.co/t/elastic-stack-6-1-3-and-5-6-7-security-update/117683 "2018-01-30T18:21:47Z")
Kibana incomplete fix for ESA-2017-23 (ESA-2018-03) The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login… --- ## [Elastic Stack 6.1.2 and 5.6.6 security update](https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [January 16, 2018, 5:08pm UTC](https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 "2018-01-16T17:08:35Z")
Logstash sensitive information disclosure issue (ESA-2018-01) When logging warnings regarding deprecated settings, Logstash could inadvertently log sensitive information. Affected Versions All versions before 6.1.2 an… --- ## [Kibana 6.1.1 security update](https://discuss.elastic.co/t/kibana-6-1-1-security-update/112520)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [December 19, 2017, 10:57pm UTC](https://discuss.elastic.co/t/kibana-6-1-1-security-update/112520 "2017-12-19T22:57:22Z")
Kibana arbitrary code execution issue (ESA-2017-24) Kibana version 6.1.0 had an arbitrary code execution vulnerability in the Math.js package which is used by math aggregations in Time Series Visual Builder. Kibana user… --- ## [Kibana 6.0.1 and 5.6.5 security update](https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [December 6, 2017, 8:06pm UTC](https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571 "2017-12-06T20:06:56Z")
Kibana cross site scripting issue (ESA-2017-22) Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or… --- ## [Beats 5.6.4 security update](https://discuss.elastic.co/t/beats-5-6-4-security-update/106739)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [November 7, 2017, 7:02pm UTC](https://discuss.elastic.co/t/beats-5-6-4-security-update/106739 "2017-11-07T19:02:16Z")
Packetbeat denial of service (ESA-2017-21) Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is … --- ## [X-Pack Alerting and Kibana 5.6.1 security update](https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [September 26, 2017, 4:56pm UTC](https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884 "2017-09-26T16:56:25Z")
X-Pack alerting privileged user multiple issues An error was found in the permission model used by X-Pack alerting whereby users mapped to certain built-in roles could create a watch that results in that user gaining el… --- ## [Elastic Cloud Enterprise 1.0.2 security update](https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [September 12, 2017, 6:20pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247 "2017-09-12T18:20:46Z")
Elastic Cloud Enterprise unsecured communication (ESA-2017-13) The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the … --- ## [X-Pack Security 5.6.0 and 5.5.3 security update](https://discuss.elastic.co/t/x-pack-security-5-6-0-and-5-5-3-security-update/100089)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [September 11, 2017, 4:20pm UTC](https://discuss.elastic.co/t/x-pack-security-5-6-0-and-5-5-3-security-update/100089 "2017-09-11T16:20:20Z")
X-Pack Security permission issue (ESA-2017-18) An error was found in the X-Pack Security privilege enforcement. If a user has either ‘delete’ or ‘index’ permissions on an index in a cluster, they may be able to issue bo… --- ## [X-Pack Security 5.5.2 security update](https://discuss.elastic.co/t/x-pack-security-5-5-2-security-update/97463)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [August 17, 2017, 5:34pm UTC](https://discuss.elastic.co/t/x-pack-security-5-5-2-security-update/97463 "2017-08-17T17:34:44Z")
X-Pack Security TLS certificate verification error (ESA-2017-15) An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be r… --- ## [Kibana 5.5.2 and 4.6.5 security update](https://discuss.elastic.co/t/kibana-5-5-2-and-4-6-5-security-update/97462)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [August 17, 2017, 5:32pm UTC](https://discuss.elastic.co/t/kibana-5-5-2-and-4-6-5-security-update/97462 "2017-08-17T17:32:58Z")
Kibana markdown parser Cross Site Scripting (XSS) error (ESA-2017-16) Kibana versions prior to 5.5.2 had a cross-site scripting (XSS) vulnerability in the markdown parser that could allow an attacker to obtain sensitive… --- ## [Elastic Stack 5.5.1 and Kibana 4.6.5 security update](https://discuss.elastic.co/t/elastic-stack-5-5-1-and-kibana-4-6-5-security-update/94513)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [July 25, 2017, 4:20pm UTC](https://discuss.elastic.co/t/elastic-stack-5-5-1-and-kibana-4-6-5-security-update/94513 "2017-07-25T16:20:13Z")
Kibana Node.js security flaw (ESA-2017-14) The version of Node.js shipped in all versions of Kibana prior to 5.5.1 contains a Denial of Service flaw in it's HashTable random seed. This flaw could allow a remote attacke… --- ## [Elastic Stack 5.5 Security update](https://discuss.elastic.co/t/elastic-stack-5-5-security-update/92150)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [July 6, 2017, 5:46pm UTC](https://discuss.elastic.co/t/elastic-stack-5-5-security-update/92150 "2017-07-06T17:46:55Z")
Elasticsearch X-Pack Security user credentials disclosure (ESA-2017-10) Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch \_nodes API leaking sensitive configuration in… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=10) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=12)