Elastic Stack 6.8.11 and 7.8.1 security update - CVE ID: CVE-2020-7017

[Prathibha_Y (Prathibha)]

Hi,

this is in reference to cve id : CVE-2020-7017 and the announcement

Elastic Stack 6.8.11 and 7.8.1 security update

Kibana regular expression denial of service flaw (ESA-2020-09) Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive. Affected Versions All versions before 7.8.1 and 6.8.11 Solutions and Mitigations Users should upgrade to Kibana version 7.8.1 or 6.8.11. Users unable to upgrade can disable Timelion by …

for our usecase, region map is a must and we cannot disable it by ‘region_map.enabled: false’.
since we have kibana 7.0 and kibana 7.8 both versions installed and running, now we cant afford to 7.9, can you please help us finding a solution for this SV.

Prathibha

[rudolf (Rudolf Meijering)]

Hi Prathibha, as per the maintenance policy outlined in https://www.elastic.co/support/eol we no longer support 7.0 and 7.8 with security fixes. You will have to upgrade to 7.9. What is holding you back from upgrading to 7.9?

[Prathibha_Y (Prathibha)]

we have customers on 7.0, so we need fix for that, but 7.8 we will upgrade