# Elastic Stack 6.5.2 security update

**URL:** <https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594>\
**Category:** Security Announcements\
**Created:** [December 5, 2018, 7:42pm UTC](https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594 "2018-12-05T19:42:41Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\
**Post date:** [December 5, 2018, 7:42pm UTC](https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594/1 "2018-12-05T19:42:41Z")

</div>

**Elasticsearch information disclosure (ESA-2018-19)**

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning’s find\_file\_structure API. If a policy allowing external network access has been added to Elasticsearch’s Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

Please note: by default Elasticsearch has the Java Security Manager enabled with policies which will cause this attack to fail.

**Affected Versions**  
Elasticsearch Security versions 6.5.0 and 6.5.1

**Solutions and Mitigations**  
Affected users should upgrade to Elasticsearch version 6.5.2.

**CVE ID: CVE-2018-17247**

---

_[View the full topic](https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594)._