Today, we have released eight service releases across the latest versions of Qlik Sense to patch the reported issues. All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted:
August 2023 Patch 1
May 2023 Patch 5
February 2023 Patch 9
November 2022 Patch 11
August 2022 Patch 13
May 2022 Patch 15
February 2022 Patch 14
November 2021 Patch 16
No workarounds can be provided. Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. The listed fixes also address CV-2023-41266 and CVE-2023-41265 (link).
November 2023 IR
August 2023 Patch 2
May 2023 Patch 6
February 2023 Patch 10
November 2022 Patch 12
August 2022 Patch 14
May 2022 Patch 16
February 2022 Patch 15
November 2021 Patch 17
This issue only impacts Qlik Sense Enterprise for Windows. Other Qlik products including Qlik Cloud and QlikView are NOT impacted.
Qlik provides patches for major releases until the next Initial or Service Release is generally available. See Release Management Policy for Qlik Software. Notwithstanding, additional patches for earlier releases may be made available at Qlik’s discretion.
No mitigation can be provided. An upgrade should be performed at the earliest. As per Qlik's best practices, the proxy should not be exposed to the public internet, which reduces the attack surface significantly.
What authentication methods are affected?
All authentication methods are affected.
Are environments with HTTP disabled impacted?
Environments will be affected regardless if HTTP or HTTPS are in use. These vulnerabilities affect the HTTP protocol overall, meaning even if HTTP is disabled, the environment remains vulnerable.
These attacks don’t rely on intercepting any communication, and therefore, are indifferent whether the HTTP communication is encrypted or not.
I have been unable to reproduce this. I installed May 2023, upgraded to patch 5 (verified versions) and then upgraded to patch 6 (and verified the versions again). It shows patch 6 being installed in the QMC and hub.
Thanks @Sonja_Bauernfeind for the quick testing. My gut says it's not a major issue and probably a one-off event.
I just met with the client and saw the issue on their side. It feels like a local cache issue, but it can be replicated in multiple browsers and incognito for him. Another user confirmed they saw similar. The ticket will be submitted in the next few minutes for this.
Does the P10 and P15 for Feb 2023 and Feb 2022 respectively address the above too, or would a new patch be published. As of now there are no new patches for these Qlik versions.
No patches are planned for versions which have reached their end of life. As per our Support Policy, Initial Releases of On-Premise Software are covered for twenty-four (24) months from the date such Initial Release was made generally available.
If you have difficulties installing Qlik Sense, please post in the appropriate forum. Include information on what you are attempting to install (fresh install, patch?) as well the version, and all required log files and error messages.
