Edited August 30th, 15:55 CET: Added clarification on older Qlik Sense Enterprise on Windows versions Edited August 31st, 13:10 CET: Added clarification on possible workarounds (none exist) as well as information regarding what authentication methods (all) are affected and that HTTP and HTTPS are impacted Edited November 21st, 8:40 CET: Added clarification to apply the latest patches
Today, we have released five service releases across the latest versions of Qlik Sense to patch the reported issues. All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted:
May 2023 Patch 3
February 2023 Patch 7
November 2022 Patch 10
August 2022 Patch 12
All prior versions of Qlik Sense Enterprise on Windows are affected, including releases such as May 2022, February 2022, and earlier. While no patches are currently listed for these versions, Qlik is actively investigating the possibility of patching older releases.
No workarounds can be provided. Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. August 2023 IR released today already contains the fix.
August 2023 Initial Release
May 2023 Patch 4
February 2023 Patch 8
November 2022 Patch 11
August 2022 Patch 13
This issue only impacts Qlik Sense Enterprise for Windows. Other Qlik products including Qlik Cloud and QlikView are NOT impacted.
No mitigation can be provided. An upgrade should be performed at the earliest. As per Qlik's best practices, the proxy should not be exposed to the public internet, which reduces the attack surface significantly.
What authentication methods are affected?
All authentication methods are affected.
Are environments with HTTP disabled impacted?
Environments will be affected regardless if HTTP or HTTPS are in use. These vulnerabilities affect the HTTP protocol overall, meaning even if HTTP is disabled, the environment remains vulnerable.
These attacks don’t rely on intercepting any communication, and therefore, are indifferent whether the HTTP communication is encrypted or not.
We are using May 2022 version in Qlik Sense Enterprise on Windows and Version upgrade will take huge time including Customer agreement/confidence on version upgrade, Testing, Customer sign off and all.
When we discussed this with Customers earlier, they like the May 2022 patch 8 stable version and don't want to break any existing functionality by simply going to higher version.
As May 2022 is under support, we would really want to have the patch for May 2022 version to fix these vulnerabilities more quickly.
While no patches are currently listed for older, Qlik is actively investigating the possibility of patching older releases. We do not yet have fixed dates. This blog post will be updated once we have more information.
@Sonja_Bauernfeind Any update on a patch for the May 2022 version? We are working in OEM method (with on-prem versions) and it isn't very easy for us to move our customers instantly to higher versions...
On 1.: Correct, the vulnerability is mitigated after you have applied the patches mentioned above. On 2. and 3.: I will come back with answers on these.
I have reported this to our download site team. It seems the IR is not listed when you have the default latest releases and latest patch selection active. If you change this selection to All releases with latest patch and select August 2023 you will have easy access to both the IR download and patch download.
