# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=9 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 10 --- ## [Kibana 8.11.1 Security Update (ESA-2023-25)](https://discuss.elastic.co/t/kibana-8-11-1-security-update-esa-2023-25/347149)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 2\ **Last updated:** [November 17, 2023, 3:18am UTC](https://discuss.elastic.co/t/kibana-8-11-1-security-update-esa-2023-25/347149 "2023-11-17T03:18:11Z")
Kibana Insertion of Sensitive Information into Log File (ESA-2023-25) An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana … --- ## [Logstash 8.11.1 Security Update (ESA-2023-26)](https://discuss.elastic.co/t/logstash-8-11-1-security-update-esa-2023-26/347191)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [November 15, 2023, 6:29am UTC](https://discuss.elastic.co/t/logstash-8-11-1-security-update-esa-2023-26/347191 "2023-11-15T06:29:05Z")
Logstash Insertion of Sensitive Information into Log File (ESA-2023-26) An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for t… --- ## [Elastic Sharepoint Online Python Connector v8.10.3.0 Security Update](https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 10, 2023, 12:18pm UTC](https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732 "2023-10-10T12:18:57Z")
Elastic Sharepoint Online Python Connector Improper Access Control (ESA-2023-18) An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python … --- ## [Endpoint v8.10.4 Security Update](https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 17, 2023, 12:07pm UTC](https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203 "2023-10-17T12:07:38Z")
Elastic Endpoint Insertion of Sensitive Information into Log File (ESA-2023-21) If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and… --- ## [Fleet Server v8.10.3 Security Update](https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 10, 2023, 12:46pm UTC](https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 "2023-10-10T12:46:07Z")
Fleet Server Insertion of Sensitive Information into Log File (ESA-2023-20) An issue was discovered in Fleet Server \>= v8.10.0 and \< v8.10.3 where Agent enrollment tokens are being inserted into the Fleet Server’s log f… --- ## [Kibana 8.10.3, 7.17.14 Security Update](https://discuss.elastic.co/t/kibana-8-10-3-7-17-14-security-update/344735)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 10, 2023, 12:40pm UTC](https://discuss.elastic.co/t/kibana-8-10-3-7-17-14-security-update/344735 "2023-10-10T12:40:01Z")
Kibana heap buffer overflow vulnerability (ESA-2023-19) On Sept 11, 2023, Google Chrome announced CVE-2023-4863, described as “Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 a… --- ## [Elastic Cloud on Kubernetes (ECK) 2.8 Security Update](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 26, 2023, 9:48am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854 "2023-09-26T09:48:13Z")
Elastic Cloud on Kubernetes (ECK) secret token configuration issue (ESA-2023-11) Secret token configuration is never applied when using ECK \<2.8 with APM Server \>=8.0. This could lead to anonymous requests to an APM Se… --- ## [Elasticsearch 8.9.0, 7.17.13 Security Update](https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [September 22, 2023, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616 "2023-09-22T11:52:47Z")
Elasticsearch uncontrolled resource consumption (ESA-2023-13) An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to … --- ## [Kibana 8.10.1 Security Update](https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [September 18, 2023, 5:53pm UTC](https://discuss.elastic.co/t/kibana-8-10-1-security-update/343287 "2023-09-18T17:53:06Z")
Kibana Insertion of Sensitive Information into Log File (ESA-2023-17) An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana ve… --- ## [Beats, Elastic Agent, APM Server, and Fleet Server 8.10.1 Security Update - Improper Certificate Validation issue (ESA-2023-16)](https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [September 19, 2023, 3:32pm UTC](https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385 "2023-09-19T15:32:21Z")
Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue (ESA-2023-16) It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify … --- ## [Elasticsearch 8.9.1 / 7.17.13 Security Update](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297)
**Author:** [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\ **Replies:** 0\ **Last updated:** [September 18, 2023, 8:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297 "2023-09-18T20:40:51Z")
Elasticsearch StackOverflow vulnerability (ESA-2023-14) A flaw was discovered in Elasticsearch, affecting the \_search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of… --- ## [Elasticsearch Security Statement regarding CVE-2022-1471](https://discuss.elastic.co/t/elasticsearch-security-statement-regarding-cve-2022-1471/343006)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [September 14, 2023, 4:53am UTC](https://discuss.elastic.co/t/elasticsearch-security-statement-regarding-cve-2022-1471/343006 "2023-09-14T04:53:14Z")
Elasticsearch is not affected by this issue. Elasticsearch is not affected by the issue described in CVE-2022-1471 as, in general, it does not use Snakeyaml to parse YAML. Summary Elasticsearch supports YAML as a format… --- ## [Elasticsearch 8.9.2 and 7.17.13 Security Update](https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [September 6, 2023, 10:30pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479 "2023-09-06T22:30:46Z")
Elasticsearch Insertion of sensitive information in audit logs (ESA-2023-12) Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was… --- ## [Elastic Cloud Enterprise (ECE) 2.13.3, 3.3.0 Security Update](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-2-13-3-3-3-0-security-update/338650)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [July 18, 2023, 9:57am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-2-13-3-3-3-0-security-update/338650 "2023-07-18T09:57:18Z")
ECE Denial of Service (DoS) issue (ESA-2023-09) A denial of service vulnerability was discovered in ECE that could lead to the ECE Admin API server becoming unavailable if a maliciously crafted JWT is supplied. This is … --- ## [Elasticsearch 8.8.2, 7.17.11 Security Update](https://discuss.elastic.co/t/elasticsearch-8-8-2-7-17-11-security-update/337205)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [June 29, 2023, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-8-8-2-7-17-11-security-update/337205 "2023-06-29T14:08:31Z")
Elasticsearch Denial of Service (DoS) issue (ESA-2023-10) This issue only affects users that have at least one OpenID Connect authentication realm or at least one JWT authentication realm configured. A denial of servic… --- ## [Elastic Stack 8.7.0, 7.17.10 Security Updates](https://discuss.elastic.co/t/elastic-stack-8-7-0-7-17-10-security-updates/332327)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [May 2, 2023, 4:01pm UTC](https://discuss.elastic.co/t/elastic-stack-8-7-0-7-17-10-security-updates/332327 "2023-05-02T16:01:34Z")
Filebeat Information Exposure (ESA-2023-04) A flaw was discovered in the Filebeat httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logg… --- ## [Endpoint Security 8.4.0/7.17.7 and Endgame 3.62.3 Security Update](https://discuss.elastic.co/t/endpoint-security-8-4-0-7-17-7-and-endgame-3-62-3-security-update/323754)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 5:34pm UTC](https://discuss.elastic.co/t/endpoint-security-8-4-0-7-17-7-and-endgame-3-62-3-security-update/323754 "2023-01-23T17:34:10Z")
Elastic Endpoint Security Local Privilege Escalation issue (ESA-2022-13) An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged use… --- ## [Endpoint Security 8.4.1 Security Update](https://discuss.elastic.co/t/endpoint-security-8-4-1-security-update/323753)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 5:30pm UTC](https://discuss.elastic.co/t/endpoint-security-8-4-1-security-update/323753 "2023-01-23T17:30:33Z")
Elastic Endpoint Security Local Privilege Escalation issue (ESA-2022-14) An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their pr… --- ## [Kibana 7.17.9 and 8.6.2 Security Update](https://discuss.elastic.co/t/kibana-7-17-9-and-8-6-2-security-update/325782)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [February 16, 2023, 10:56pm UTC](https://discuss.elastic.co/t/kibana-7-17-9-and-8-6-2-security-update/325782 "2023-02-16T22:56:41Z")
Kibana open redirect issue (ESA-2023-03) An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. Affected Versions… --- ## [Kibana 7.17.8 and 8.5.0 Security Update](https://discuss.elastic.co/t/kibana-7-17-8-and-8-5-0-security-update/320920)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [December 9, 2022, 7:18pm UTC](https://discuss.elastic.co/t/kibana-7-17-8-and-8-5-0-security-update/320920 "2022-12-09T19:18:11Z")
Update Log 2022-12-23: Updated impact section with additional details. 2023-01-09: Updated impact section to include RHEL 2023-01-23: Updated impact section with additional details. Updated Solutions and Mitigations s… --- ## [Elastic 7.17.9, 8.5.0 and 8.6.1 Security Update](https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [February 3, 2023, 2:30pm UTC](https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661 "2023-02-03T14:30:50Z")
Kibana authenticated Denial of Service issue (ESA-2023-02) A flaw(CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to to perform a request that crashes th… --- ## [Elastic Security Statement for OpenSSL CVE-2022-3786 and CVE-2022-3602, OpenSSL version 3.0.7](https://discuss.elastic.co/t/elastic-security-statement-for-openssl-cve-2022-3786-and-cve-2022-3602-openssl-version-3-0-7/318039)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [November 2, 2022, 6:41pm UTC](https://discuss.elastic.co/t/elastic-security-statement-for-openssl-cve-2022-3786-and-cve-2022-3602-openssl-version-3-0-7/318039 "2022-11-02T18:41:01Z")
Elastic Products are not affected by this issue. On Oct 25, 2022, Elastic became aware of the Forthcoming OpenSSL 3.0.7 Release announcement, which was made available on Nov 1, 2022. The security issues addressed in thi… --- ## [Elastic Cloud Enterprise 3.1.1 Security Update](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 4:15am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317 "2022-09-28T04:15:37Z")
Elastic Cloud Enterprise Sensitive information disclosure issue (ESA-2022-11) A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in de… --- ## [Elastic Cloud Enterprise 3.4.0 Security Update](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-4-0-security-update/312825)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 3:42pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-4-0-security-update/312825 "2022-08-24T15:42:00Z")
Elastic Cloud Enterprise Sensitive information disclosure issue (ESA-2022-10) A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch… --- ## [Elastic Stack 8.4.0, 7.17.6 Security Statement](https://discuss.elastic.co/t/elastic-stack-8-4-0-7-17-6-security-statement/312823)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 3:07pm UTC](https://discuss.elastic.co/t/elastic-stack-8-4-0-7-17-6-security-statement/312823 "2022-08-24T15:07:32Z")
Elastic Statement for Oracle July Critical Patch Update CVE-2022-21540, CVE-2022-21541, CVE-2022-21549, CVE-2022-25647, CVE-2022-34169 Summary: Oracle released their July Critical Patch Update for Java SE which contains… --- ## [Elastic 8.3.1, 8.3.0, and 7.17.5 Security Update](https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [June 30, 2022, 8:32pm UTC](https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613 "2022-06-30T20:32:13Z")
Kibana cross-site-scripting (XSS) issue (ESA-2022-08) A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s br… --- ## [Elastic Stack 7.17.4 and 8.2.1 Security Update](https://discuss.elastic.co/t/elastic-stack-7-17-4-and-8-2-1-security-update/305530)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [May 24, 2022, 4:55pm UTC](https://discuss.elastic.co/t/elastic-stack-7-17-4-and-8-2-1-security-update/305530 "2022-05-24T16:55:27Z")
Elastic Stack update for CVE-2022-21449 Java vulnerability in Elliptic Curve Digital Signature Algorithm (ECDSA) (ESA-2022-06) A vulnerability (CVE-2022-21449) affecting the implementation of Elliptic Curve Digital Sign… --- ## [Kibana 7.17.3 and 8.1.3 Security Update](https://discuss.elastic.co/t/kibana-7-17-3-and-8-1-3-security-update/302826)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [April 20, 2022, 2:20pm UTC](https://discuss.elastic.co/t/kibana-7-17-3-and-8-1-3-security-update/302826 "2022-04-20T14:20:34Z")
Kibana Exposure of Sensitive Information (ESA-2022-05) A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide… --- ## [Elastic Stack 7.17.1 Security Update](https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 0\ **Last updated:** [February 28, 2022, 9:24pm UTC](https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447 "2022-02-28T21:24:04Z")
Elasticsearch privilege escalation issue (ESA-2022-02) A flaw was discovered in elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security … --- ## [Kibana 7.17.0 Security Update](https://discuss.elastic.co/t/kibana-7-17-0-security-update/296215)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [February 3, 2022, 5:34pm UTC](https://discuss.elastic.co/t/kibana-7-17-0-security-update/296215 "2022-02-03T17:34:35Z")
Kibana Cross-site scripting issue (ESA-2022-01) An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious jav… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=8) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=10)