Security

Barra de búsqueda
Volver a Security

Elastic Stack and Liferay Enterprise Search [LES] Security Advisories

Effective January 1, 2026, Elasticsearch CVEs will be published on the Liferay Security Reports page.

Please note that this page will remain active for High or Critical severity vulnerabilities affecting Kibana, as well as for other important security updates related to the Elastic Stack and Liferay Enterprise Search. As before, you can find all the security alerts published by Elastic here​.

General Notes on CVEs Affecting Elasticsearch

Elasticsearch CVEs and other Third-Party CVEs Detected in Liferay's Sidecar Elasticsearch Runtime

The Elasticsearch server runtime included in Liferay DXP Tomcat Bundles and Docker Images (aka. Sidecar Elasticsearch, located under [Liferay-Home]/elasticsearch-sidecar / /opt/liferay/elasticsearch-sidecar) is neither suitable nor supported for production. It is provided as a convenience for local development and testing only. Instead, configure Liferay to connect to Elasticsearch as a self-managed, standalone server or cluster of server nodes. 

The Sidecar Elasticsearch (including all of its bundled plugins and libraries) cannot be patched or updated through Liferay hotfixes. Liferay does not possess additional vulnerability and exploitability information beyond that provided in public security alerts by Elastic. Security scans can report false-positive vulnerabilities when analyzing the Liferay DXP Tomcat Bundles or Docker images because of the inclusion of the Sidecar Elasticsearch runtime.

Additionally, since using Elasticsearch Sidecar in production is not supported, users can simply delete the elasticsearch-sidecar directory to remove these vulnerable modules from the bundle. Example commands for 2024.q3.13 release:

The -slim Liferay DXP Docker images do not include the Sidecar Elasticsearch runtime. 

Vulnerabilities in Elasticsearch can only be addressed with new releases by Elastic. The compatible Elasticsearch versions and the Sidecar Elasticsearch version is updated periodically with newer Liferay DXP Quarterly Releases. Customers are advised to update their Elasticsearch installations to the latest compatible versions. 

Elasticsearch CVEs and other Third-Party CVEs Detected in Liferay's Elasticsearch Connector

Security scans can report false-positive vulnerabilities for Liferay DXP due to Elasticsearch dependencies. Elasticsearch CVEs typically affect the server environment rather than the Java client and its dependencies used by Liferay DXP's connector.

The elasticsearch-X.Y.Z.jar JARs included within the Elasticsearch connector, under [Liferay Home]/osgi/portal/com.liferay.portal.search.elasticsearch*.impl.jar#lib, can trigger false-positive reports, since security scanning tools have no awareness of how this dependency is used and associate it with the Elasticsearch server itself. In reality, this dependency is included solely to implement the low-level Liferay Search Java APIs within the connector, in a client capacity — it is not used directly to run Elasticsearch as a server.

That said, every security report is analyzed in line with our standard security practices, and Liferay will plan appropriate mitigations as needed, unless noted otherwise on the Liferay Security Reports page.

General Note on CVEs Affecting Kibana

Liferay DXP and the Liferay Enterprise Search Monitoring application which integrates Kibana's UI as a proxy into Liferay DXP, do not include the binaries of the Kibana application itself. It is not possible to patch or update Kibana through the installation of Liferay hotfixes or upgrading to newer quarterly releases. In addition, Liferay does not have further information about the vulnerabilities and their exploit-ability beyond what's shared in the public security alerts issued by the vendor (Elastic).

Vulnerabilities in Kibana can only be addressed with new releases by Elastic. Customers are advised to update their Elasticsearch and Kibana installations to the latest compatible versions.

Advisories

Vendor References

Here you can find the security alerts published by Elastic.

Elastic, Elasticsearch, and X-Pack are trademarks of Elasticsearch BV, registered in the U.S. and in other countries.

On this page