CVE-2020-7016: Kibana regular expression denial of service flaw (ESA-2020-09) Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive. Affected Versions All versions before 7.8.1 and 6.8.11 Solutions and Mitigations Users should upgrade to Kibana version 7.8.1 or 6.8.11. Users unable to upgrade can disable Timelion by setting timelion.enabled to false in the kibana.yml configuration file. CVE-2020-7017: The region map visualization in Kibana contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization. Affected Versions All versions of Kibana are affected by this flaw Solutions and Mitigations Users should upgrade to Kibana version 7.8.1 or 6.8.11. Users unable to upgrade can set ‘xpack.maps.enabled: false’, ‘region_map.enabled: false’, and ‘tile_map.enabled: false’ in kibana.yml to disable map visualizations. Users running version 6.7.0 or later have a reduced risk from this XSS vulnerability when Kibana is configured to use the default Content Security Policy with a modern browser. While the CSP prevents XSS, it does not mitigate the underlying HTML injection vulnerability.
Maintainers, please bump.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3c435545dd3133785849ab04840fac5f8604ae7a commit 3c435545dd3133785849ab04840fac5f8604ae7a Author: Tomáš Mózes <hydrapolic@gmail.com> AuthorDate: 2020-07-29 19:40:34 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-07-30 18:16:49 +0000 www-apps/kibana-bin: bump to 7.8.1 Bug: https://bugs.gentoo.org/734154 Signed-off-by: Tomáš Mózes <hydrapolic@gmail.com> Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> www-apps/kibana-bin/Manifest | 2 + www-apps/kibana-bin/kibana-bin-7.8.1.ebuild | 90 +++++++++++++++++++++++++++++ 2 files changed, 92 insertions(+)
Thanks. Please cleanup.
Tree clean
(In reply to Tomáš Mózes from comment #4) > Tree clean Thanks!
