Edited August 30th, 15:55 CET: Added clarification on older Qlik Sense Enterprise on Windows versionsEdited August 31st, 13:10 CET: Added clarification on possible workarounds (none exist) as well as information regarding what authentication methods (all) are affected and that HTTPandHTTPS are impactedEdited November 21st, 8:40 CET: Added clarification to apply thelatestpatches
Hello Qlik Users,
Two security issues in Qlik Sense Enterprise for Windows have been identified and patches made available. Details can be found in Security Bulletin Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265).
This announcement from August 2023 and the mentioned releases only cover CVE-2023-41266 and CVE-2023-41265. Apply the most recent patches as documented in Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-48365)(September 2023), which resolve CVE-2023-48365 as well.
Today, we have released five service releases across the latest versions of Qlik Sense to patch the reported issues. All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted:
May 2023 Patch 3
February 2023 Patch 7
November 2022 Patch 10
August 2022 Patch 12
All prior versions of Qlik Sense Enterprise on Windows are affected, including releases such as May 2022, February 2022, and earlier. While no patches are currently listed for these versions, Qlik is actively investigating the possibility of patching older releases.
No workarounds can be provided. Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. August 2023 IR released today already contains the fix.
August 2023 Initial Release
May 2023 Patch 4
February 2023 Patch 8
November 2022 Patch 11
August 2022 Patch 13
This issue only impacts Qlik Sense Enterprise for Windows. Other Qlik products including Qlik Cloud and QlikView are NOT impacted.
All Qlik software can be downloaded from our official Qlik Download page (customer login required). Follow best practices when upgrading Qlik Sense.
The information in this post and Security Bulletin Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)are disclosed in accordance with our published Security and Vulnerability Policy.
Clarifications and Frequently Asked Questions:
What can be done to mitigate the issue?
No mitigation can be provided. An upgrade should be performed at the earliest. As per Qlik's best practices, the proxy should not be exposed to the public internet, which reduces theattack surface significantly.
What authentication methods are affected?
All authentication methods are affected.
Are environments with HTTP disabled impacted?
Environments will be affected regardless if HTTP or HTTPS are in use. These vulnerabilities affect the HTTP protocol overall, meaning even if HTTP is disabled, the environment remains vulnerable.
These attacks don’t rely on intercepting any communication, and therefore, are indifferent whether the HTTP communication is encrypted or not.
Kind regards, and thank you for choosing Qlik,
Qlik Global Support
...View More
Welcome to Qlik, we’re excited to have you onboard and can’t wait to see how our solutions will help achieve your data and analytics goals.
Ready to take the first step? Start Here!
We’ve gathered the essential resources for you to follow and set up your own tenant along the way. With comprehensive implementation steps, a Go Live Checklist, and training recommendations for your end users, we’ll guide you through getting your environment up and running for your organization.
Log into Qlik Continuous Classroom with your Qlik Account to access this free, curated onboarding content for Qlik Cloud Admins.
If you need help as you get started, chat with our Support Engineers 24/5.
Happy learning!
Qlik Customer Success
...View More
This is our second monthly Qlik Data Integration newsletter. Each month, we cover one endpoint and share our top resources, best practices, release updates and upcoming webinars.
Subscribe to theQlikData Integrationtopic to be notified of future editions!
Index
Resource HighlightsWebinarsKnowledgebase ArticlesRetiring Qlik Replicate EndpointsAnalyze Qlik Replicate LogsEndpoint Spotlight: SQL ServerNew Issues ReportedTips!Release UpdatesFixesEnhancementsNew ReleasesQlik Data Integration Product End of Life Versions
Resource Highlights
Webinars
(Update) Book your calendar for the upcoming Q&A with Qlik: New to Qlik CloudQ&A sessionscheduled forAugust 15th at 10:00 AM EDT. It is a live Q&A session with a panel of Qlik experts. Bring your questions, and we do our best to answer them.
Explore Qlik Support's recorded Techspert webinar series on-demand or visit ourYouTube Channelto discover more!
Techspert Talks
Q&A with Qlik
Knowledgebase Articles
Retiring Qlik Replicate Endpoints
As of July 31st, 2023, the following endpoints will be retired:
Source Endpoints:
HP Non-Stop Source
Open VMS RMS Source
Hadoop Source
Target Endpoints:
MapR Target
MapR Streams Target
MS APS PDW Target
SAP Sybase IQ Target
HP Vertica Target
Actian Vector Target
Netezza Target
Pivotal Greenplum Target
SeeRetirement for Specific Qlik Replicate Endpointsfor details.
Analyze Qlik Replicate Logs
An evergreen pair of articles helps you read and analyze Qlik Replicate log files:
How to analyze a Qlik Replicate logList of the error types in Qlik Replicate
Endpoint Spotlight: SQL Server
Find our latest knowledge base articles for SQL Server endpoints.
New Issues Reported
Qlik Replicate Task logs a warning: ]W: MS-REPLICATION is not enabled for table
Find the resolution inQlik Replicate Task logs a warning: ]W: MS-REPLICATION is not enabled for table.
Qlik Replicate: [SQL Server]Login failed
The behavior began after an upgrade to Qlik Replicate version 2022.11 or later.Find the resolution inQlik Replicate: [SQL Server]Login failed after an upgrade to Qlik Replicate 2022.11 or later.
Tips!
Qlik Replicate Red Hat 8 SQL Server Source fails TCP Provider: Error code 0x2746
Qlik Replicate 2022.5 fails to connect to SQL Server Source Endpoint when connecting from Red Had Linux 8 using the libmsodbcsql-17.10.so.1.1 or libmsodbcsql-17.6.so.1.1. Qlik Replicate Red Hat 8 SQL Server Source fails TCP Provider: Error code 0x2746for details.
Qlik Replicate: SQL Server idle connections closed
Inactive TCP/IP connections to SQL Server can sometimes be closed by your router or firewall. This will give your task a recoverable environmental error. Parameters in the Windows Registry can be set to send transmissions for the connection to keep it active. For more information, seeQlik Replicate: SQL Server idle connections force closed.
Best Practice:Qlik Replicate: SQL replication jobs
If you use a non-sysadmin account to replicate data from SQL Source, then the DBA must update the owner of all SQL Server jobs belonging to ‘REPL%’ category to the SA account.Qlik Replicate will not create or manage any of the SQL Agent jobs.
Best Practice:SQL Server Source - Rebuild Index Best Practices and Recommendations
Release Updates
Fixes
Qlik Replicate May 2023 SP1
Type: Issue
Component/Process: Microsoft Azure SQL (MS-CDC) and Microsoft SQL Server (MS-CDC) targets
Description: The task would fail when DB_ID() returned a different value than database_id in sys.databases. The issue was resolved using an internal parameter.
Type: Issue
Component/Process: Microsoft SQL Server Source
Description: An online transaction log is read sometimes slow, add an internal property to control the number of rows being read in one request.
Type: Issue
Component/Process: SQL Server Source
Description: sp_repldone truncation prevention does not work with specific collation
Type: Issue
Component/Process: Transformation
Description: A transformation expression that separates keywords by a new line, cannot be executed causing SQLite errors.
Type: Issue
Component/Process: MySql Source
Description: When NOT NULL column is defined as AUTOINCREMENTED, it is exposes as NULLABLE.
Type: Issue
Component/Process: MySQL Source
Description: When replicating a high volume of data, starting the task or retrieving the table list would take an excessively long time or get stuck. The issue was resolved using an internal parameter.
Enhancements
Qlik Replicate August 2023 SR
New Confluence Endpoint (based on Kafka)
Qlik Replicate November 2023 IR
Expose stream buffer tuning parameters in task settings as per ideation request:Replicate & QEM - Expose stream buffer tuning parameters in task settings
Confluent Schema Register using BOTH authentication methods (Public Key + Username & password)
MariaDB new version certifications
New Releases
(Updated) Available on the Download Page
Qlik Replicate 2022.11 SP06
Qlik Enterprise Manager 2022.11 SP06
Qlik Data Integration Product End of Life Versions
Qlik Release
Qlik Replicate / Enterprise Manager
End of Support Date
Qlik Compose
End of Support Date
February 2021
November 2020 SR1
November 2022
February 2021
February 2023
May 2021
May 2021
May 2023
May 2021
May 2023
August 2021
May 2021 SR1
May 2023
August 2021
August 2023
November 2021
November 2021
November 2023
November 2021
November 2023
For more information, see Qlik Product Lifecycles.
...View More
We are pleased to introduce the first major launch of over 20 connectors for Qlik Cloud Data Integration enabling you to leverage both full and incremental data load from these popular Cloud Application sources.
For this release you will find below connectors made available to you:
Adobe Analytics
Oracle Netsuite
Shopify
Coupa
Pendo
SuccessFactors
Google 360 Analytics V4
Percipio (Skillsoft)
Sugar CRM
Jira
Qualtrics
SurveyMonkey
Marketo
Salesforce
Twitter
Microsoft Dynamic 365 CRM
SAP Concur
WorkDay
Microsoft Azure Active Directory
ServiceNow
Zuora
How to start using the feature:
These connectors will be tagged as Preview and access will need to be requested via your Qlik Customer Success Manager or Qlik Support providing your tenant details and the connectors you are interested in using.
A requirement is to have set-up Data Gateway - Data Movement. For more information, see Qlik Data Gateway - Data Movement overview.
Once this is done you will need to:
Connect to a SaaS application.
Select your processing (Reload and Compare vs Change Data Capture).
Scan the data for metadata generation.
Add datasets to the metadata.
Reload metadata
More detailed instructions are available on our help site.
Additional resources:
SaaS in 60 - New Cloud Application Sources in Qlik Cloud Data Integration (Video)
Walkthrough: Cloud Application Sources - Qlik Cloud Data Integration (Video)
Thanks for choosing Qlik!
Qlik Global Support
...View More
This is our inaugural edition of our Monthly Newsletter for Qlik Data Integration updates. We'll cover one endpoint per month and share our top resources, best practices, release updates and upcoming webinars.Subscribe to the QlikData Integration topic to be notified of future editions!
Index
Resource Highlights:WebinarsKnowledgebase ArticlesAnalyze Qlik Replicate LogsEndpoint Spotlight: OracleNew Issues ReportedTips! Release UpdatesFixesEnhancementsQlik Data Integration Product End of Life Versions:
Resource Highlights:
Webinars
Book your calendar for the upcoming Qlik Replicate Q&A session scheduled for July 25th at 10:00 AM EDT. It is a live Q&A session with a panel of Qlik experts. Bring your questions, and we do our best to answer them.
Explore Qlik Support's recorded Techspert webinar series on-demand or visit ourYouTube Channel to discover more!
Techspert Talks
Q&A with Qlik
Knowledgebase Articles
Analyze Qlik Replicate Logs
We have put together a comprehensive guide on how to analyze Qlik Replicate log files. The guide will show you how to verify what version you are running what types of tasks are being run, and more:How to analyze a Qlik Replicate log
In addition, we've compiled aList of the error types in Qlik Replicate.
Endpoint Spotlight: Oracle
Find our latest knowledge base articles for Oracle endpoints.
New Issues Reported
Resume tasks failing after upgrading to 2022.11 SP03(.475) and SP04(.546).
The correct SCN is not stored when the task is stopped. The task cannot be resumed due to the wrong SCN captured.Find theresolution inQlik Replicate with Oracle endpoint: Resume tasks failing after upgrading to 2022.11 SP03(.475) and SP04(.546).
Qlik Replicate captures no Data after the Oracle Source has been upgraded to 4 Node RAC
The SCN value of the Qlik Replicate task is no longer valid after the Oracle environment upgrade as the SCN has changed.Find the resolution in Qlik Replicate captures no Data after the Oracle Source has been upgraded to 4 Node RAC.
Qlik Replicate using Oracle source fails with missing redo log
Qlik Replicate is always reading V$archived_log to get the archived REDO information. The redo log needs to have an active/available status from the V$archived_log.
Find a solution to this error inReplicate using Oracle source fails with missing redo log.
Tips!
How to start a Replicate task with Oracle source endpoint from a requested SCN
To find the current SCN value follow the steps in How to start a Replicate task with Oracle source endpoint from a requested SCN.
What is the usage of Oracle directories in Replicate Oracle source?
Find answers for the following related question:
Purpose for creation of directories in Oracle (Source)
What are files we are going to keep in these directories
What storage required for the directories
If files are going to keep in the directories then what will be the retention period
What's the usage of Oracle directories in Replicate Oracle source
Best Practice:Configure Oracle ASM with copy redo logs to a temporary folder
When the Copy redo logs to temporary folder option is enabled, Qlik Replicate instructs Oracle to copy the full redo log or chunks of the redo log to a local folder residing on the Oracle Server machine or to a shared network folder accessible by Oracle Server.
Find out more inConfigure Oracle ASM with copy redo logs to a temporary folder.
Release Updates
Fixes
Qlik Replicate May 2023 SP1
Type: Issue
Component/Process: Oracle Source - Replicate Log Reader
Description: Added support for Oracle DIRECT INSERT statements with PARALLEL_DML for non-compressed pages.
Enhancements
August 2023 SR
New Confluent Endpoint (based on Kafka)
November 2023 IR
Confluent Schema Register using BOTH authentication methods (Public Key + Username & password)
Expose stream buffer tuning parameters in task settings per ideation request:Replicate & QEM - Expose stream buffer tuning para... - Qlik Community - 1763259
Note: To request features, share ideas, and upvote other ideas check out our ideation platform:Request | Feedback (qlik.com)
Qlik Data Integration Product End of Life Versions:
Qlik Release
Qlik Replicate / Enterprise Manager
End of Support Date
Qlik Compose
End of Support Date
February 2021
November 2020 SR1
November 2022
February 2021
February 2023
May 2021
May 2021
May 2023
May 2021
May 2023
August 2021
May 2021 SR1
May 2023
August 2021
August 2023
November 2021
November 2021
November 2023
November 2021
November 2023
For more information, see Qlik Product Lifecycles.
...View More
Update: Dec 14, 2022
Qlik can confirm that this includes the lower severity issue CVE-2022-3786 which was announced by OpenSSL at the same time.
-----------------------------------------------------------------------------------------------------------------------------------------
Update: Nov 2, 2022
Qlik hascompleted its review of thisthird-party vulnerability and concluded it does not impact any Qlik product or service
-----------------------------------------------------------------------------------------------------------------------------------------
Update Nov 1, 2022:
The OpenSSL team has assigned the CVE reference CVE-2022-3602 to this issue and downgraded the severity to HIGH – please see https://www.openssl.org/news/secadv/20221101.txt .Despite the lower severity, Qlik is continuing to review its products and services to ensure there are no concerns. At this time, no exposure has been identified.
-----------------------------------------------------------------------------------------------------------------------------------------
Original, October 31, 2022:
Qlik is aware that the OpenSSL project has announced that a critical security issue will be patched in a release targeted for November 1, 2022.
Although we cannot be certain that there will be no impact to Qlik’s products and services until the full details are made public, initial indications are that Qlik is not impacted by this OpenSSL vulnerability.
As more details become available, Qlik will review and update this page accordingly. Subscribe to this post to receive notifications when updated.
Additional information:
https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html
...View More
A node.js security update released new versions of14.x, 16.x, and 18.x to address three medium and two high severity issues.
Impact
Client-managed Qlik Sense Enterprise on Windows release versions prior to November 2021 are affected.
Recommendation
It is recommended affected users upgrade to the following releases:
November 2021 latest patch
February 2022 latest patch
May 2022 latest patch
August 2022 IR
To download the latest patch, log into Qlik Community with your Qlik ID, and navigate to our downloads page. Filter by Data Analytics, Qlik Sense Enterprise on Windows, and find the latest version to upgrade to.
...View More
Qlik is aware that a set of well publicized vulnerabilities have been identified in the popular Java Spring Framework. These vulnerabilities have been assigned references CVE-2022-22965 (also known as "Spring4Shell"), CVE-2022-22947, CVE-2022-22950 and CVE-2022-22963.
CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ (Critical)CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability (Critical)
CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression (Critical)
CVE-2022-22950: Spring Expression DoS Vulnerability (Medium)
Qlik has been diligently reviewing our product suite since we’ve become aware of these issues. We want to ensure Qlik users that your security is our upmost priority. As always, we recommend customers stay up-to-date on the most recent releases available for your product.
Products Not Impacted
The following products are NOT affected:
Qlik Cloud
Client-Managed Qlik Sense Enterprise and QlikView (all versions)
GeoAnalytics (all versions)
Qlik Compose (all versions)
Qlik Compose for Data Lakes (all versions)
Qlik Compose for Data Warehouses (all versions)
Qlik Enterprise Manager (all versions)
Qlik NPrinting
Qlik Replicate (all versions) **
** Qlik Replicate contains libraries that contain the affected code, but they are not used in a way that is exploitable. These will be removed in a upcoming patch.
Products Impacted
Our testing shows only client-managed versions of Qlik Catalog are directly impacted (by CVE-2022-22965 and CVE-2022-22950) and a patch will be available as Feb 2022 SR2 and for the May 2022 release. Mitigation steps for earlier releases are linked in this knowledge base article.
Update 4/04/2022 8:15p.m EST
Qlik Catalog Feb 2022 SR2 is now available on the Downloads Site.Please be sure to be logged into Qlik Community with your Qlik ID to access.
Please subscribe to our Support Updates blog for continued updates as they become available.
Thank you for choosing Qlik,
Qlik Global Support
...View More
