# Elastic Stack 6.8.11 and 7.8.1 security update - CVE ID: CVE-2020-7017

**URL:** <https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update-cve-id-cve-2020-7017/254237>\
**Category:** Kibana\
**Created:** [November 4, 2020, 9:44am UTC](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update-cve-id-cve-2020-7017/254237 "2020-11-04T09:44:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prathibha\_Y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prathibha_y/32/95786_2.png) [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\
**Post date:** [November 4, 2020, 9:44am UTC](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update-cve-id-cve-2020-7017/254237/1 "2020-11-04T09:44:25Z")

</div>

Hi,

this is in reference to cve id : CVE-2020-7017 and the announcement

> [@Elastic Stack 6.8.11 and 7.8.1 security update](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786):
>
> Kibana regular expression denial of service flaw (ESA-2020-09) Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive. Affected Versions All versions before 7.8.1 and 6.8.11 Solutions and Mitigations Users should upgrade to Kibana version 7.8.1 or 6.8.11. Users unable to upgrade can disable Timelion by …

for our usecase, region map is a must and we cannot disable it by ‘region\_map.enabled: false’.  
since we have kibana 7.0 and kibana 7.8 both versions installed and running, now we cant afford to 7.9, can you please help us finding a solution for this SV.

Prathibha

---

<div class="post-metadata">

**Author:** ![rudolf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudolf/32/51200_2.png) [@rudolf](https://discuss.elastic.co/u/rudolf)\
**Post date:** [November 4, 2020, 11:55am UTC](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update-cve-id-cve-2020-7017/254237/2 "2020-11-04T11:55:42Z")

</div>

Hi Prathibha, as per the maintenance policy outlined in [https://www.elastic.co/support/eol](https://www.elastic.co/support/eol) we no longer support 7.0 and 7.8 with security fixes. You will have to upgrade to 7.9. What is holding you back from upgrading to 7.9?

---

<div class="post-metadata">

**Author:** ![Prathibha\_Y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prathibha_y/32/95786_2.png) [@Prathibha\_Y](https://discuss.elastic.co/u/Prathibha_Y)\
**Post date:** [November 5, 2020, 8:17am UTC](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update-cve-id-cve-2020-7017/254237/3 "2020-11-05T08:17:16Z")

</div>

we have customers on 7.0, so we need fix for that, but 7.8 we will upgrade

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2020, 8:17am UTC](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update-cve-id-cve-2020-7017/254237/4 "2020-12-03T08:17:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.