# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=8 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 9 --- ## [Elasticsearch 7.17.21 and 8.13.3 Security Update (ESA-2024-25)](https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [January 21, 2025, 10:49am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442 "2025-01-21T10:49:35Z")
Elasticsearch allocation of resources without limits or throttling leads to crash (ESA-2024-25) An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resultin… --- ## [Elastic Defend 8.13.3 Security Update (ESA-2024-24)](https://discuss.elastic.co/t/elastic-defend-8-13-3-security-update-esa-2024-24/373441)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [January 21, 2025, 10:48am UTC](https://discuss.elastic.co/t/elastic-defend-8-13-3-security-update-esa-2024-24/373441 "2025-01-21T10:48:45Z")
Elastic Defend Improper Handling of Alternate Encoding Leads to Crash (ESA-2024-24) Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a m… --- ## [Elasticsearch 8.16.2 / 8.17.0 Security Update](https://discuss.elastic.co/t/elasticsearch-8-16-2-8-17-0-security-update/372091)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [December 17, 2024, 8:29pm UTC](https://discuss.elastic.co/t/elasticsearch-8-16-2-8-17-0-security-update/372091 "2024-12-17T20:29:06Z")
Elasticsearch Incorrect Authorization (ESA-2024-46) An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elas… --- ## [APM Server 8.14.0 Security Update (ESA-2024-09)](https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-09/364946)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 15, 2024, 9:54am UTC](https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-09/364946 "2024-08-15T09:54:42Z")
APM Server - Uncontrolled Resource Consumption through HTTP/2 endpoints - CVE-2023-45288 (ESA-2024-09) On April 4, 2024, the Go Project announced CVE-2023-45288, which can lead to CPU exhaustion as an attacker can cause… --- ## [Kibana 8.14.2 / 7.17.23 Security Update (ESA-2024-22)](https://discuss.elastic.co/t/kibana-8-14-2-7-17-23-security-update-esa-2024-22/364424)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 1\ **Last updated:** [August 12, 2024, 9:28pm UTC](https://discuss.elastic.co/t/kibana-8-14-2-7-17-23-security-update-esa-2024-22/364424 "2024-08-12T21:28:13Z")
Kibana arbitrary code execution via prototype pollution (ESA-2024-22) A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write acc… --- ## [Elastic Agent 8.15.0 Security Update (ESA-2024-23)](https://discuss.elastic.co/t/elastic-agent-8-15-0-security-update-esa-2024-23/364635)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [August 8, 2024, 11:33pm UTC](https://discuss.elastic.co/t/elastic-agent-8-15-0-security-update-esa-2024-23/364635 "2024-08-08T23:33:32Z")
Elastic Agent Insertion of Sensitive Information into Log File (ESA-2024-23) An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured… --- ## [Kibana 8.7.1 Security Updates (ESA-2023-07, ESA-2023-08)](https://discuss.elastic.co/t/kibana-8-7-1-security-updates-esa-2023-07-esa-2023-08/332330)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [May 2, 2023, 4:08pm UTC](https://discuss.elastic.co/t/kibana-8-7-1-security-updates-esa-2023-07-esa-2023-08/332330 "2023-05-02T16:08:35Z")
Kibana arbitrary code execution (ESA-2023-07) Kibana contains an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute… --- ## [APM Server 8.14.0 Security Update (ESA-2024-19)](https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-19/364289)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [August 2, 2024, 8:20pm UTC](https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-19/364289 "2024-08-02T20:20:04Z")
APM Server Insertion of Sensitive Information into Log File (ESA-2024-19) APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable\_shards\_exception for a speci… --- ## [Elasticsearch 8.13.0/7.17.23 Security Update (ESA-2024-12)](https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 5:12pm UTC](https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157 "2024-07-31T17:12:52Z")
Elasticsearch elasticsearch-certutil csr fails to encrypt private key (ESA-2024-12) It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new… --- ## [Kibana 7.17.23/8.14.0 Security Update (ESA-2024-16)](https://discuss.elastic.co/t/kibana-7-17-23-8-14-0-security-update-esa-2024-16/364094)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 9:22pm UTC](https://discuss.elastic.co/t/kibana-7-17-23-8-14-0-security-update-esa-2024-16/364094 "2024-07-30T21:22:31Z")
Kibana Denial of Service issue (ESA-2024-16) An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific… --- ## [Elastic Cloud Enterprise 3.7.2 Security Update (ESA-2024-18)](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-2-security-update-esa-2024-18/362181)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 4:54am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-2-security-update-esa-2024-18/362181 "2024-06-28T04:54:13Z")
ECE Improper Authorization (ESA-2024-18) It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys th… --- ## [Kibana 7.17.22 / 8.14.0 Security Update (ESA-2024-17)](https://discuss.elastic.co/t/kibana-7-17-22-8-14-0-security-update-esa-2024-17/361508)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [June 14, 2024, 3:27pm UTC](https://discuss.elastic.co/t/kibana-7-17-22-8-14-0-security-update-esa-2024-17/361508 "2024-06-14T15:27:57Z")
Kibana RCE due to chromium type confusion (ESA-2024-17) On March 26, 2024, a type confusion vulnerability was found in WebAssembly in Google Chrome version prior to 123.0.6312.86 which allows a remote attacker to execut… --- ## [Kibana 8.14.0/7.17.22 Security Update (ESA-2024-10)](https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update-esa-2024-10/361502)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [June 14, 2024, 2:09pm UTC](https://discuss.elastic.co/t/kibana-8-14-0-7-17-22-security-update-esa-2024-10/361502 "2024-06-14T14:09:17Z")
Kibana open redirect issue (ESA-2024-10). An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. Affected Versio… --- ## [Elasticsearch 8.14.0 Security Update (ESA-2024-14)](https://discuss.elastic.co/t/elasticsearch-8-14-0-security-update-esa-2024-14/361007)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [June 7, 2024, 4:06am UTC](https://discuss.elastic.co/t/elasticsearch-8-14-0-security-update-esa-2024-14/361007 "2024-06-07T04:06:51Z")
Elasticsearch StackOverflow vulnerability (ESA-2024-14) A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain c… --- ## [Kibana 8.14.0 Security Update (ESA-2024-15)](https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [June 5, 2024, 8:45pm UTC](https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887 "2024-06-05T20:45:40Z")
Kibana Broken Access Control issue (ESA-2024-15) A flaw was discovered in Kibana, allowing view-only users of alerting to use the run\_soon API making the alerting rule run continuously, potentially affecting the system … --- ## [Elasticsearch 8.14.0 Security Update (ESA-2024-13)](https://discuss.elastic.co/t/elasticsearch-8-14-0-security-update-esa-2024-13/360898)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [June 6, 2024, 3:32am UTC](https://discuss.elastic.co/t/elasticsearch-8-14-0-security-update-esa-2024-13/360898 "2024-06-06T03:32:51Z")
Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions (ESA-2024-13) It was identified that if a cross-cluster API key restricts search for a given index using the query or the field\_security … --- ## [Elastic Cloud Enterprise 3.7.1 Security Update (ESA-2024-08)](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-1-security-update-esa-2024-08/360888)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [June 5, 2024, 8:57pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-1-security-update-esa-2024-08/360888 "2024-06-05T20:57:45Z")
Elastic Cloud Enterprise - Uncontrolled Resource Consumption through HTTP/2 endpoints - CVE-2023-45288 (ESA-2024-08) On April 4, 2024, the Go Project announced CVE-2023-45288, which can lead to CPU exhaustion as an atta… --- ## [Elastic Security Statement for CVE-2024-3094, xz versions 5.6.0 and 5.6.1](https://discuss.elastic.co/t/elastic-security-statement-for-cve-2024-3094-xz-versions-5-6-0-and-5-6-1/357894)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 22, 2024, 9:19am UTC](https://discuss.elastic.co/t/elastic-security-statement-for-cve-2024-3094-xz-versions-5-6-0-and-5-6-1/357894 "2024-04-22T09:19:38Z")
Elastic Products are not affected by this issue. On March 29th, 2024, Elastic became aware of the malicious code planted in the xz package. Elastic has performed an investigation to identify any Elastic Products which … --- ## [Elasticsearch 8.11.1 Security Update (ESA-2024-05)](https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 29, 2024, 11:12am UTC](https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458 "2024-03-29T11:12:33Z")
Elasticsearch Uncaught Exception (ESA-2024-05) An uncaught exception in Elasticsearch \>= 8.4.0 and \< 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch inges… --- ## [Elasticsearch 8.13.0 Security Update (ESA-2024-07)](https://discuss.elastic.co/t/elasticsearch-8-13-0-security-update-esa-2024-07/356315)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-8-13-0-security-update-esa-2024-07/356315 "2024-03-27T16:53:56Z")
Elasticsearch Improper Authorization in the Remote Cluster Security API key based security model (ESA-2024-07) It was identified by the Elastic engineering team that the API key based security model for Remote Cluster S… --- ## [Elasticsearch 8.13.0 / 7.17.19 Security Update (ESA-2024-06)](https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [March 27, 2024, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314 "2024-03-27T16:53:36Z")
Elasticsearch Uncontrolled Resource Consumption vulnerability (ESA-2024-06) A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch… --- ## [Kibana 8.12.1, 7.17.18 Security Update (ESA-2024-04)](https://discuss.elastic.co/t/kibana-8-12-1-7-17-18-security-update-esa-2024-04/352805)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [February 7, 2024, 10:07pm UTC](https://discuss.elastic.co/t/kibana-8-12-1-7-17-18-security-update-esa-2024-04/352805 "2024-02-07T22:07:29Z")
Kibana heap buffer overflow vulnerability (ESA-2024-04) This issue requires authenticated access to Kibana. On Dec 21, 2023, Google Chrome announced CVE-2023-7024, described as “Heap buffer overflow in WebRTC in Google… --- ## [Elastic Network Drive Connector 8.12.1 Security Update (ESA-2024-02)](https://discuss.elastic.co/t/elastic-network-drive-connector-8-12-1-security-update-esa-2024-02/352687)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [February 6, 2024, 10:23pm UTC](https://discuss.elastic.co/t/elastic-network-drive-connector-8-12-1-security-update-esa-2024-02/352687 "2024-02-06T22:23:10Z")
Elastic Network Drive Connector Improper Access Control (ESA-2024-02) An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allo… --- ## [Kibana 8.12.1 Security Update (ESA-2024-01)](https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [February 6, 2024, 10:13pm UTC](https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-01/352686 "2024-02-06T22:13:13Z")
Kibana Broken Access Control issue (ESA-2024-01) An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the… --- ## [Beats and Elastic Agent 8.11.3 / 7.17.16 Security Update (ESA-2023-30)](https://discuss.elastic.co/t/beats-and-elastic-agent-8-11-3-7-17-16-security-update-esa-2023-30/349180)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [December 12, 2023, 5:00pm UTC](https://discuss.elastic.co/t/beats-and-elastic-agent-8-11-3-7-17-16-security-update-esa-2023-30/349180 "2023-12-12T17:00:31Z")
Beats and Elastic Agent Insertion of Sensitive Information into Log File An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting th… --- ## [Kibana 8.11.2, 7.17.16 Security Update (ESA-2023-27)](https://discuss.elastic.co/t/kibana-8-11-2-7-17-16-security-update-esa-2023-27/349182)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [December 12, 2023, 5:23pm UTC](https://discuss.elastic.co/t/kibana-8-11-2-7-17-16-security-update-esa-2023-27/349182 "2023-12-12T17:23:12Z")
Kibana Insertion of Sensitive Information into Log File (ESA-2023-27) An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug l… --- ## [Enterprise Search 8.11.2 / 7.17.16 Security Update (ESA-2023-31)](https://discuss.elastic.co/t/enterprise-search-8-11-2-7-17-16-security-update-esa-2023-31/349181)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [December 12, 2023, 5:06pm UTC](https://discuss.elastic.co/t/enterprise-search-8-11-2-7-17-16-security-update-esa-2023-31/349181 "2023-12-12T17:06:41Z")
Enterprise Search Insertion of Sensitive Information into Log File (ESA-2023-31) An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. … --- ## [Elasticsearch 8.11.2, 7.17.16 Security Update (ESA-2023-29)](https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [December 12, 2023, 4:57pm UTC](https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179 "2023-12-12T16:57:56Z")
Elasticsearch Insertion of Sensitive Information into Log File (ESA-2023-29) An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw cont… --- ## [Elasticsearch-hadoop 7.17.11 / 8.9.0 Security Update (ESA-2023-28)](https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [December 5, 2023, 4:27pm UTC](https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663 "2023-12-05T16:27:11Z")
Elasticsearch-hadoop Unsafe Deserialization (ESA-2023-28) An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by au… --- ## [Elasticsearch 7.17.14 / 8.10.3 Security Update (ESA-2023-24)](https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [November 22, 2023, 9:18am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708 "2023-11-22T09:18:16Z")
Elasticsearch Improper Handling of Exceptional Conditions (ESA-2023-24) It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling … [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=7) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=9)