# Does Elasticsearch and kibana use bzip2 **URL:** \ **Category:** Kibana\ **Tags:** docker\ **Created:** [March 17, 2021, 12:41pm UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507 "2021-03-17T12:41:01Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![nkarthik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkarthik/32/85686_2.png) [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Post date:** [March 17, 2021, 12:41pm UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/1 "2021-03-17T12:41:01Z")
Hi, Does kibana or Elasticsearch use bzip2 ? If yes, How can I check what is the current version? ---
**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\ **Post date:** [March 17, 2021, 7:11pm UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/2 "2021-03-17T19:11:55Z")
In what capacity are you wondering about? Do we have a distribution available that is of type bzip2? Or do we utilize bzip2 at all within our product? ---
**Author:** ![nkarthik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkarthik/32/85686_2.png) [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Post date:** [March 22, 2021, 3:40am UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/3 "2021-03-22T03:40:34Z")
Hi @tylersmalley, I'm wondering if Elasticsearch or kibana utilize bzip2. To give some more context, Actually I was looking at one of the CVE( [CVE-2019-12900](https://security-tracker.debian.org/tracker/CVE-2019-12900) ). In our scan for CVE's, elasticsearch and kibana got flagged for this particular CVE. Although when I tried to search for the verion used by kibana and elasticsearch, I failed to find if elasticsearch and kibana utilises bzip2 or not. ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [March 22, 2021, 9:23am UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/4 "2021-03-22T09:23:29Z")
> [@nkarthik](#): > > In our scan for CVE's, elasticsearch and kibana got flagged for this particular CVE Hi @nkarthik what version of the stack you're talking about? Also are you talking about Elasticsearch/Kibana distributions or about our Docker images? Can you give us a little bit more details? Thanks, Oleg ---
**Author:** ![nkarthik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkarthik/32/85686_2.png) [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Post date:** [March 22, 2021, 10:53am UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/5 "2021-03-22T10:53:46Z")
Hi @azasypkin, I'm currently using version 7.3.2 stack. I'm referring to the Docker Image. Does elasticsearch/kibana v7.3.2 utilize bzip2 package. If Yes, how can I find bzip2 current version ? ---
**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\ **Post date:** [March 22, 2021, 2:24pm UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/6 "2021-03-22T14:24:29Z")
Got it, thanks. @nkarthik would you mind forwarding your question to `security@elastic.co`? I'd suggest using this address to ask any CVE-related questions or concerns in the future as well. This way you'll always get an accurate answer. Thanks, Oleg ---
**Author:** ![nkarthik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkarthik/32/85686_2.png) [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Post date:** [March 22, 2021, 2:50pm UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/7 "2021-03-22T14:50:29Z")
Sure, Thanks @azasypkin. ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [March 24, 2021, 6:14pm UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/8 "2021-03-24T18:14:50Z")
Here is the response I sent to @nkarthik via our security@ address (just to close the loop for anyone paying attention). Kibana does not use the bzip2 in any way. There is no way a remote attacker could exploit this vulnerability. The container in question contains the package bzip2-libs which appears to be where the vulnerability in question is coming from. I looked up Red Hat's response to this issue, they do not plan to fix it due to it having a low impact. [https://access.redhat.com/security/cve/cve-2019-12900](https://access.redhat.com/security/cve/cve-2019-12900) We follow Red Hat on these issues, if they do not update the package, there is nothing we can do in our containers as we are not operating system vendors. ---
**Author:** ![nkarthik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkarthik/32/85686_2.png) [@nkarthik](https://discuss.elastic.co/u/nkarthik)\ **Post date:** [March 26, 2021, 3:07am UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/9 "2021-03-26T03:07:38Z")
Thank you @joshbressers for confirming. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 23, 2021, 3:08am UTC](https://discuss.elastic.co/t/does-elasticsearch-and-kibana-use-bzip2/267507/10 "2021-04-23T03:08:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.