Qlik Sense on Windows: Node.Js Vulnerability for versions prior to Nov. 2021

[Katie_Davis]

A node.js security update released new versions of14.x, 16.x, and 18.x to address three medium and two high severity issues.  

Impact 

Client-managed Qlik Sense Enterprise on Windows release versions prior to November 2021 are affected. 

Recommendation 

It is recommended affected users upgrade to the following releases: 

• November 2021 latest patch 
• February 2022 latest patch 
• May 2022 latest patch 
• August 2022 IR  

To download the latest patch, log into Qlik Community with your Qlik ID, and navigate to our downloads page.  Filter by Data Analytics, Qlik Sense Enterprise on Windows, and find the latest version to upgrade to.  

[SivenM2020]

Hi,

Thanks for the update.

Is the severity of this vulnerability, high for public facing Qlik Sense servers only?

Meaning, needs to be upgraded ASAP

And, for other private/internal customer QSEoW servers can be planned as phased upgrade process?

[rva]

Hello!

According to https://community.qlik.com/t5/Product-Support-Lifecycle/Qlik-Sense-Enterprise-on-Windows-Product-Lif... also the versions Qlik Sense Sept 2020 - Qlik Sense Aug 2021 are still under support. 

Will these versions get a Patch release?

Thx,

Roland

[sri_c003]

We would like to know the patch to use for February 2021 (still under support).

[fabrice_lawson]

@SivenM2020  please read https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ to get detailed information about the vulnerabilities. It is recommended that our customers upgrade accordingly. 

[fabrice_lawson]

@rva Thanks for the post, there will not be any further patch releases on prior versions than November 2021 due to complex compatibility challenges with the updates by Nodejs. We recommend an upgrade to the available tracks, November 2021 or later. 

[fabrice_lawson]

@sri_c003 It is recommended to upgrade to November 2021 latest patch or later track ¨

Thanks

Fabrice