Need info regarding Kibana Timelion Remote Code Execution issue (ESA-2019-02)

[fragatina]

Hi,

I'm evaluating the Kibana Timelion Remote Code Execution issue (ESA-2019-02) CVE from:

Elastic Stack 6.6.1 and 5.6.15 security update

Kibana XSS issue (ESA-2019-01) Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. Affected Versions Kibana versions before 5.6.15 and 6.6.1 Solutions and Mitigations: Users should upgrade to Kibana version 6.6.1 or 5.6.15 CVE ID: CVE-2019-7608 Kibana Timelion Remote Code Execution issue (ESA-2019-02) Kibana versions before …

I'd really appreciate if somebody could point out to the GitHub patch for this fix.

Thanks.

[nickpeihl]

The PR for fixing this is here: https://github.com/elastic/kibana/pull/28834

[fragatina]

Thanks @nickpeihl for your support on this.
Just to confirm, from what you say, ESA-2019-01 and ESA-2019-02 are both the same pull 28834?
Thanks

[nickpeihl]

@fragatina It appears to be the same PR for both. But you can email security@elastic.co for more info.

[fragatina]

Thanks @nikpeihl for your help on this.

[Harsha_Sri]

Hi, I am looking for the patch that's fixing the ESA-2019-01 XSSvulnerability. So Can we confirm that both ESA-2019-01 and ESA-2019-02 have the same PR's and Patches. Thanks in advance for the help