Skip to content

[Security] 8.19.20 release notes #7196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
natasha-moore-elastic wants to merge 1 commit into from
Closed

[Security] 8.19.20 release notes #7196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/release-notes.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

This section summarizes the changes in each release.

* <<release-notes-8.19.20, {elastic-sec} version 8.19.20>>
* <<release-notes-8.19.19, {elastic-sec} version 8.19.19>>
* <<release-notes-8.19.18, {elastic-sec} version 8.19.18>>
* <<release-notes-8.19.17, {elastic-sec} version 8.19.17>>
Expand Down
32 changes: 32 additions & 0 deletions docs/release-notes/8.19.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,38 @@
[[release-notes-header-8.19.0]]
== 8.19

[discrete]
[[release-notes-8.19.20]]
=== 8.19.20

[discrete]
[[enhancements-8.19.20]]
==== Enhancements

* Defaults the {ls} output port to `5044` in {elastic-defend} when no port is provided.

[discrete]
[[bug-fixes-8.19.20]]
==== Fixes
* Fixes an issue where the **Source event** link in an alert's **Highlighted fields** section failed to open the document when it lived in a hidden restored or partial index ({kibana-pull}282272[#282272]).
* Fixes a privilege bypass that allowed users with detection rule privileges to attach {elastic-defend} or Osquery response actions through the generic Alerting API without the required Endpoint or Osquery privileges ({kibana-pull}280430[#280430]).
* Fixes the analyzer alert-hits query so it honors the `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting, which previously excluded cold and frozen tiers only from other analyzer queries ({kibana-pull}278972[#278972]).
* Fixes a crash when opening the rule panel flyout for a deleted rule caused by missing `severity_mapping` or `risk_score_mapping` fields ({kibana-pull}278545[#278545]).
* Fixes an issue where {kib} assets from an installed integration package (such as dashboards used by prebuilt detection rules) could remain stale across a {kib} upgrade because {fleet} never overwrote existing assets on reinstall ({kibana-pull}277953[#277953]).
* Fixes a crash in index fields formatting when a field or index is named after an `Object.prototype` property such as `constructor`, `toString`, or `__proto__` ({kibana-pull}277851[#277851]).
* Fixes an error when opening a source event from the **Highlighted fields** section of the alert details flyout when the source index had been restored, and renamed, from a cold or frozen tier ({kibana-pull}277703[#277703]).
* Fixes an issue where the `concurrent_searches` and `items_per_search` API fields for `threat_match` (Indicator Match) rules were reset to their defaults when the rule was saved through the UI ({kibana-pull}276823[#276823]).
* Fixes **Investigate in Timeline** for Indicator Match alerts by quoting and escaping KQL values that contain reserved characters, such as `:` in URLs ({kibana-pull}271639[#271639]).
* Fixes an issue where {elastic-defend} WFP firewall anti-tamper rules were not reinstated after a restart when the policy had not changed.
* Fixes a CPU spin loop in {elastic-defend} that could occur when a middlebox (such as Zscaler or a load balancer) dropped a TLS connection to the {ls} or {es} output with a TCP RST, pinning one CPU core and preventing event delivery until the agent was restarted.
* Fixes an issue where {elastic-defend} immediately retried sending documents when {es} failed to ingest them.
* Fixes {elastic-defend} on Windows so TLS handshakes succeed against servers that send a leaf-only certificate chain when the issuing intermediate CA is installed in the Windows Intermediate CA store, matching the behavior of other Elastic components.
* Fixes an issue in {elastic-defend} on Windows where the Windows Intermediate CA store was loaded into OpenSSL's trust anchor store alongside Trusted Root CAs. On hosts with cross-signed CA certificates sharing identical Subject/Issuer distinguished names, this could cause TLS handshake failures with a "certificate chain too long" error against otherwise valid certificate chains.
* Fixes {elastic-defend} notifications not appearing on macOS Sonoma and later.
* Fixes an {agent} upgrade issue caused by an {elastic-defend} verify command failure that logged `Unable to start endpoint to check version: exit status 2, try install` every 30 seconds on affected endpoints.
* Fixes a resource leak in {elastic-defend} Lua libraries.
* Preserves source and destination details for outbound IPv6 TCP connections in {elastic-defend} on Linux.

[discrete]
[[release-notes-8.19.19]]
=== 8.19.19
Expand Down
Loading