Skip to content

Commit 1760e2d

Browse files
authored
[Backport][Docs] Adds security fix to 7.x RN (#53507)
* updates release notes * added html vulnerability * corrections after review
1 parent 763d2f4 commit 1760e2d

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

docs/CHANGELOG.asciidoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,13 @@ Machine Learning::
6666
* Fixes lat_long anomalies table links menu and value formatting {pull}50916[#50916]
6767
* Fixes loading of data visualizer with KQL saved search {pull}51882[#51882]
6868
Maps::
69+
* Fixes a cross-site scripting (XSS) flaw in Coordinate and Region Map
70+
visualizations. An attacker could create a malicious visualization that
71+
executes JavaScript in a victim’s browser when the visualization, or dashboard
72+
containing the visualization, was viewed. Since Kibana 7.0.0, Content Security
73+
Policy (CSP), which prevents attackers from using this flaw, is enabled by
74+
default. However, an attacker can still inject arbitrary HTML into the page.
75+
See https://www.elastic.co/community/security/, CVE-2019-7621.
6976
* Prevents users from overflowing URL when filtering by shape {pull}50747[#50747]
7077
* Delays vector tile layer syncing until spritesheet is loaded {pull}48955[#48955]
7178
* Sanitizes attribution {pull}52309[#52309]

0 commit comments

Comments
 (0)