The following issues may affect your Liferay-Elastic stack.

CVE	Severity	Vulnerability Summary	Affected Product	Affected Versions	Solutions & Mitigations
CVE-2024-37279	CVSSv3: 4.3(Medium)	Kibana Broken Access Control issue	Kibana	8.6.3 through 8.13.4	Learn more.
CVE-2024-23445	CVSSv3: 6.5(Medium)	Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions	Elasticsearch	8.10.0 through 8.14.0	Learn more.
CVE-2024-37280	CVSSv3: 4.9(Medium)	Elasticsearch StackOverflow vulnerability	Elasticsearch	8.13.1 through 8.13.4	Learn more.
CVE-2024-23443	CVSSv3.1: 4.9(Medium)	Kibana uncontrolled resource consumption	Kibana	7.x before 7.17.22, 8.x before 8.14.0	Learn more
CVE-2024-23442	CVSSv3: 6.1(Medium)	Kibana open redirect issue	Kibana		Learn more.
CVE-2024-2887	CVSSv3: 9.9 (Critical)	Kibana RCE due to chromium type confusion	Kibana		Learn more.
CVE-2024-37281	CVSSv3: 6.5(Medium)	Kibana Denial of Service issue	Kibana	7.x before 7.17.23, 8.x before 8.14.0	Learn more.
CVE-2024-23444	CVSSv3: 4.9(Medium)	Elasticsearch elasticsearch-certutil csr fails to encrypt private key	Elasticsearch	7.x before 7.17.23, 8.x before 8.13.0	Learn more.
CVE-2024-37287	CVSSv3.1: 9.1(Critical)	Kibana arbitrary code execution via prototype pollution	Kibana	7.7.0 through 7.17.22, 8.x before 8.14.2	Learn more.

 

Additional Information

The testing process to verify the compatibility with Elasticsearch and Kibana 8.14 and 8.15 is currently scheduled to be started and the updated Search Engine Compatibility Matrix is expected to be published later in August, early September.

• Regarding the CVEs affecting Kibana: The Liferay Enterprise Search Monitoring application, used to integrate Kibana's UI as a proxy into Liferay, does not include the binaries of the Kibana application itself. Patching or updating Kibana through the installation of Liferay hotfixes or upgrading to newer quarterly releases is not applicable. In addition, Liferay does not have further information about the vulnerabilities and their exploit-ability beyond what's shared in the public security alerts issued by the vendor (Elastic).
• Regarding CVE-2024-37280: Liferay's out-of-the-box implementation does not use "passthrough" type in the field mappings affected by the vulnerability.
• Regarding CVE-2024-23444: Liferay's Elasticsearch integration does not use the elasticsearch-certutil directly. This utility is only executed by users when setting-up and configuring Elasticsearch with security.
• Regarding CVE-2024-23445: Liferay's features do not use cross-cluster API key affected by the vulnerability.

The next scheduled bump of the bundled Sidecar Elasticsearch server (convenient for development and testing, not is suitable for production, neither supported) can be tracked here.

Search Engine Compatibility

As usual, Liferay recommends to its customers to upgrade their production Elastic stack to the latest available and compatible release of 7.x/8.x. Reference the information here for the detailed Elasticsearch compatibility including the compatible connector versions and required update/patch levels.