Edited December 5th: identified upgrades leading to complications with extensions Edited December 6th: added workaround for extension complication Edited December 10th: added CVEs (CVE-2024-55579 and CVE-2024-55580) Edited December 12th, noon CET: added new patch versions and visualization and extension fix details; previous patches were removed from the download site
Hello Qlik Users,
New patches have been made available and have replaced the original six releases. They include the original security fixes (CVE-2024-55579 and CVE-2024-55580) as well as QB-30633 to resolve the extension and visualization defect.
Today, we have released six service releases across the latest versions of Qlik Sense to patch the reported issue. All versions of Qlik Sense Enterprise for Windowsprior to and including these releases are impacted:
May 2024 Patch 9
February 2024 Patch 13
November 2023 Patch 15
August 2023 Patch 15
May 2023 Patch 17
February 2023 Patch 14
No workarounds can be provided. Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. November 2024 IR, released on the 26th of November, contains the fix as well.
November 2024 Initial Release
May 2024 Patch 10 or 11 (both valid)
February 2024 Patch 14 or 15 (both valid)
November 2023 Patch 16 or 17 (both valid)
August 2023 Patch 16 or 17 (both valid)
May 2023 Patch 18 or 19 (both valid)
February 2023 Patch 15 or 16 (both valid)
This issue only impacts Qlik Sense Enterprise for Windows. Other Qlik products including Qlik Cloud and QlikView are NOT impacted.
The Security Notice label is used to notify customers about security patches and upgrades that require a customer’s action. Please subscribe to the ‘Security Notice’ label to be notified of future updates.
@Benoit_C I applied the "workaround" now and it actually brought the missing folders back (StaticContent/Extensions/ -> sn-text, sn-shape and sn-layout-container). I don't know how that happened, but it did.The folders are timestamped at the same time as I restarted the services after having applied the workaround text in the config file. I'm still on May2024 P10, haven't updated to P11. I don't understand how this operation brought the folders back, but it seems it did.
Here is what support suggested: If possible, please upgrade to patch 11 now that all your extensions are back. Then verify if the extensions are still in place. If they are not, please reimport them as per Installing and removing Qlik Sense Extension bundle.
We would appreciate feedback on how the upgrade goes for you and which steps you had to take.
@Sonja_Bauernfeind I applied patch 11 now and the extensions have remained so I believe my issues are solved now. Thanks! (This was in dev environment, will apply workaround and p11 in prod environment after office hours.)
@Benoit_C No I did not have to reinstall the qlik dashboard bundle*. That's kind of confusing, actually. I could clearly see that the extension folders sn-shape, sn-text and sn-layout-container were missing. They simply weren't there, and that's still the case in my production environment. They must have been removed when I applied Patch 10 (May 24) a few days ago, only I did not notice until today. They did't exist on disk in the StaticContent/Extensions directory, and they could not be seen under extensions in QMC and were not available as frontend objects at all
When I applied the "workaround" that consists of adding the key VisualizationExtensionsExtractFilter to Repository.exe.config and restarted the qlik services, these folders magically reappeared and the folders' timestamps are the same timestamp as when I restarted the services.
The extensions also became visible in qmc/extensions and became available for use as objects in edit-mode in QS frontend.
*Previously I wrote visualization bundle, but it was the dashboard bundle. Available now in my dev environment where I have applied this fix, still missing in production environment where I will apply the fix later tonight.
@henrikalmen maybe it's just the fact to restart repository service that have reinstalled the extension? Not necessarily because of the Repository.exe.config modification.
@Benoit_C Yes, that thought occurred to me as well right after I posted my last comment. I'll try that first in prod environment tonight - just restart services and see what happens.
