Qlik Sense Enterprise for Windows - New Security Patches Available Now

[Sonja_Bauernfeind]

Edited December 5th: identified upgrades leading to complications with extensions
Edited December 6th: added workaround for extension complication
Edited December 10th: added CVEs (CVE-2024-55579 and CVE-2024-55580)
Edited December 12th, noon CET: added new patch versions and visualization and extension fix details; previous patches were removed from the download site

Hello Qlik Users,

New patches have been made available and have replaced the original six releases. They include the original security fixes (CVE-2024-55579 and CVE-2024-55580) as well as QB-30633 to resolve the extension and visualization defect.

If you continue to experience issues with extensions or visualizations, see QB-30633: Visualizations and Extensions not loading after applying patch.

Security issues in Qlik Sense Enterprise for Windows have been identified, and patches have been made available. Details can be found in Security Bulletin High Severity Security fixes for Qlik Sense Enterprise for Windows (CVE-2024-55579 and CVE-2024-5558....

Today, we have released six service releases across the latest versions of Qlik Sense to patch the reported issue. All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted:

• May 2024 Patch 9
• February 2024 Patch 13
• November 2023 Patch 15
• August 2023 Patch 15
• May 2023 Patch 17
• February 2023 Patch 14

No workarounds can be provided. Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. November 2024 IR, released on the 26th of November, contains the fix as well. 

• November 2024 Initial Release
• May 2024 Patch 10 or 11 (both valid)
• February 2024 Patch 14 or 15 (both valid)
• November 2023 Patch 16 or 17 (both valid)
• August 2023 Patch 16 or 17 (both valid)
• May 2023 Patch 18 or 19 (both valid)
• February 2023 Patch 15 or 16 (both valid)

This issue only impacts Qlik Sense Enterprise for Windows. Other Qlik products including Qlik Cloud and QlikView are NOT impacted.

All Qlik software can be downloaded from our official Qlik Download page (customer login required). Follow best practices when upgrading Qlik Sense.

The information in this post and Security Bulletin High Severity Security fixes for Qlik Sense Enterprise for Windows (CVE-2024-55579 and CVE-2024-5558... are disclosed in accordance with our published Security and Vulnerability Policy.

The Security Notice label is used to notify customers about security patches and upgrades that require a customer’s action. Please subscribe to the ‘Security Notice’ label to be notified of future updates. 

Thank you for choosing Qlik,
Qlik Global Support

[rva]

A customer told me after applying Patch 10 on May2024 

- Layout Container 
- and the new Textbox

have disappeard. I will open a support case as well.

[Sonja_Bauernfeind]

Hello @Eduardo_Monteiro @fosuzuki3 @ajourdan1684153368 @fmarvnnt and @rva 

We've identified the problem and are actively working on addressing it (internal investigation ID: QB-30633). I'll keep the blog post updated.

All the best,
Sonja 

[makunii]

Hello @Sonja_Bauernfeind.

Is this investigation for patch 10 on May 24 only?

Regards,
Marco

[Samv22]

Hi Sonja,
Please let us know if other versions are affected as well so we can put the update activity on hold ?
My concern is for Aug 2023

[GeorgeSavu]

Hi @Sonja_Bauernfeind ,

November 2024 seems not to be affected, May 2024 is affected. 

Could you please tell us which versions are affected and which are not ?

BR,
George

[makunii]

Hi Samv22,

We did a test on August 2023 and we can see the same problem. Attempting to import an extension results in "Failed to import extension. Please check the log file". Everything works fine if we remove the patch.

Regards,

Marco

[makunii]

Hi @Sonja_Bauernfeind,

Do you have any new about the fix?

I have more than 15 customers waiting for.

Thank you.

Marco

[Katie_Davis]

@makunii @Samv22 @Eduardo_Monteiro @fosuzuki3 @ajourdan1684153368 @fmarvnnt and @rva 

Hi All, 

A fix has been shared for those experiencing extension issues and added to the Security Bulletin's resolution section: High Security fixes for Qlik Sense Enterprise for ... - Qlik Community - 2495696

For those who have upgraded and are affected by complications with extensions, follow the fix below:

These steps have been verified for all 2023 patches (February to November) and are being verified for 2024 (February and May). The November 2024 release is not affected. 

1. Stop the Repository service
   
   
2. Open file C:\Program Files\Qlik\Sense\Repository\Repository.exe.config
   
   
3. Go to the section <appSettings>
   
   
4. Add the key VisualizationExtensionsExtractFilter as the last key in the <appSettings> section:
   
   <add key="VisualizationExtensionsExtractFilter" value="md|css|js|json|pdf|png|qext|txt|html|htm|gif|jpg|jpeg|wbl|otf|ttf|woff|woff2|eot|svg|bmp|mp3|jp2"/>
   
   
5. Save the file
   
   
6. Restart the following services:
   
   
   1. Qlik Sense Repository Service
   2. Qlik Sense Printing Service
   3. Qlik Sense Scheduler Service
   4. Qlik Sense Engine Service
   5. Qlik Sense Proxy Service

[rva]

@Katie_Davis, @Sonja_Bauernfeind :Great this fixed the issue for my customer! The two extension objects are now working in May 2024 Patch10!

Thx,
Roland

[Sonja_Bauernfeind]

Thank you for the confirmation, @rva !