Skip to content

[Security] 8.19.20 release notes #7197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
natasha-moore-elastic merged 3 commits into from
Aug 11, 2026
Merged

[Security] 8.19.20 release notes #7197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
02722cc
[Security] 8.19.20 release notes
natasha-moore-elastic Aug 7, 2026
eeadeb8
Apply suggestions from code review
natasha-moore-elastic Aug 7, 2026
bec3f99
remove PRs that didn't go into 8.19.19
natasha-moore-elastic Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/release-notes.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

This section summarizes the changes in each release.

* <<release-notes-8.19.20, {elastic-sec} version 8.19.20>>
* <<release-notes-8.19.19, {elastic-sec} version 8.19.19>>
* <<release-notes-8.19.18, {elastic-sec} version 8.19.18>>
* <<release-notes-8.19.17, {elastic-sec} version 8.19.17>>
Expand Down
35 changes: 32 additions & 3 deletions docs/release-notes/8.19.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,38 @@
[[release-notes-header-8.19.0]]
== 8.19

[discrete]
[[release-notes-8.19.20]]
=== 8.19.20

[discrete]
[[enhancements-8.19.20]]
==== Enhancements

* Defaults the {ls} output port to `5044` in {elastic-defend} when no port is provided.

[discrete]
[[bug-fixes-8.19.20]]
==== Fixes
* Fixes an issue where the **Source event** link in an alert's **Highlighted fields** section failed to open the document when it lived in a hidden restored or partial index ({kibana-pull}282272[#282272]).
* Fixes a privilege bypass that allowed users with detection rule privileges to attach {elastic-defend} or Osquery response actions through the generic Alerting API without the required Endpoint or Osquery privileges ({kibana-pull}280430[#280430]).
* Fixes the analyzer alert-hits query so it honors the `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting, which previously excluded cold and frozen tiers only from other analyzer queries ({kibana-pull}278972[#278972]).
* Fixes a crash when opening the rule panel flyout for a deleted rule caused by missing `severity_mapping` or `risk_score_mapping` fields ({kibana-pull}278545[#278545]).

@bmorelli25 bmorelli25 Aug 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one already exists in 8.19.19 rn's.

* Fixes an issue where {kib} assets from an installed integration package (such as dashboards used by prebuilt detection rules) could remain stale across a {kib} upgrade because {fleet} never overwrote existing assets on reinstall ({kibana-pull}277953[#277953]).

@bmorelli25 bmorelli25 Aug 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same for this one

* Fixes a crash in index fields formatting when a field or index is named after an `Object.prototype` property such as `constructor`, `toString`, or `__proto__` ({kibana-pull}277851[#277851]).
* Fixes an error when opening a source event from the **Highlighted fields** section of the alert details flyout when the source index had been restored, and renamed, from a cold or frozen tier ({kibana-pull}277703[#277703]).

@bmorelli25 bmorelli25 Aug 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same for this one

@natasha-moore-elastic natasha-moore-elastic Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm all of these originally had the 8.19.19 label, which was later replaced with 8.19.20.
Looking at the 8.19.19 build, none of these actually made it into 8.19.19, so I'll remove them from there.
Thanks for flagging!

* Fixes an issue where the `concurrent_searches` and `items_per_search` API fields for `threat_match` (Indicator Match) rules were reset to their defaults when the rule was saved through the UI ({kibana-pull}276823[#276823]).
* Fixes **Investigate in Timeline** for Indicator Match alerts by quoting and escaping KQL values that contain reserved characters, such as `:` in URLs ({kibana-pull}271639[#271639]).
* Fixes an issue where {elastic-defend} WFP firewall anti-tamper rules were not reinstated after a restart when the policy had not changed.
* Fixes a CPU spin loop in {elastic-defend} that could occur when a middlebox (such as Zscaler or a load balancer) dropped a TLS connection to {ls} or {es}, preventing event delivery until the agent was restarted.
* Fixes an issue where {elastic-defend} immediately retried sending documents when {es} failed to ingest them.
* Fixes a TLS handshake failure in {elastic-defend} on Windows when a server sends a leaf-only certificate chain and the issuing intermediate CA is installed in the Windows Intermediate CA store.
* Fixes a TLS handshake failure ("certificate chain too long") in {elastic-defend} on Windows with cross-signed CA certificates in the Intermediate CA store.
* Fixes {elastic-defend} notifications not appearing on macOS Sonoma and later.
* Fixes an {agent} upgrade issue caused by an {elastic-defend} verify command failure that logged `Unable to start endpoint to check version: exit status 2, try install` every 30 seconds on affected endpoints.
* Fixes a resource leak in {elastic-defend} Lua libraries.
* Preserves source and destination details for outbound IPv6 TCP connections in {elastic-defend} on Linux.

[discrete]
[[release-notes-8.19.19]]
=== 8.19.19
Expand All @@ -14,9 +46,6 @@
[discrete]
[[bug-fixes-8.19.19]]
==== Fixes
* Fixes an issue where opening the rule details flyout for a deleted rule crashed the {security-app} when the rule was missing `severity_mapping` or `risk_score_mapping` values ({kibana-pull}278545[#278545]).
* Fixes an issue where {kib} assets from an installed integration package (such as dashboards used by prebuilt detection rules) could remain stale across a {kib} upgrade because {fleet} never overwrote existing assets on reinstall ({kibana-pull}277953[#277953]).
* Fixes an issue where the **Source event** link in an alert's **Highlighted fields** section failed to open the document when its source index had been restored (for example, from a cold or frozen tier) and renamed ({kibana-pull}277703[#277703]).
* Fixes a denial of service (DoS) vulnerability in {kib}'s Timeline bulk export functionality ({kibana-pull}260265[#260265]).
* Updates the bundled `curl` library in {elastic-defend}, improving the stability of network operations on Linux.
* Fixes an issue in {elastic-defend} that could result in incomplete addresses in network event tracking.
Expand Down
Loading