Elastic Stack and Liferay Enterprise Search Security Advisory: CVE-2022-1364

The following issues may affect the functionality of your Liferay DXP, Liferay Enterprise Search environment and your Elastic Stack.

Vulnerability Information

Kibana reporting vulnerability (ESA-2022-12)

A type confusion vulnerability was discovered in the headless Chromium browser that Kibana relies on for its reporting capabilities.

This issue affects only on-premises Kibana installations on host Operating Systems where Chromium sandbox is disabled 8 (only CentOS, Debian).

This issue does not affect Elastic Cloud, as the Chromium sandbox is enabled by default and cannot be disabled.

Affected Versions:

Kibana versions 7.0.0 through 7.17.7 and 8.0.0 through 8.4.3

Solutions and Mitigations:

The issue is fixed in Kibana versions 8.5.0 and 7.17.8.

If you are unable to upgrade, you can:

Disable Kibana reporting functionality completely with xpack.reporting.enabled: false in your kibana.yml file

CVSSv3.1: 8.8 (High) AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE ID: CVE-2022-1364

Reference the information here for the detailed Elasticsearch compatibility including the compatible connector versions and required patch levels.

Elastic, Elasticsearch, and X-Pack are trademarks of Elasticsearch BV, registered in the U.S. and in other countries.