tri vo Thank you for reaching out. The vulnerabilities mentioned are all related to the bundled Elasticsearch instance. We are currently bundling the latest 7.17.x version. Unfortunately, we cannot upgrade Elasticsearch to a newer major version without potentially breaking existing customer projects. Furthermore, there are currently no known exploits involving Elasticsearch in combination with the affected libraries.
However, there are two options to address these vulnerabilities:
Remove Elasticsearch from LTS 10
If you do not require business data functionality on LTS 10, you can remove the elasticsearch directory from your Engine installation. This will prevent the Elasticsearch instance from starting.
Upgrade to LTS 12
LTS 10 will reach end of support within the next few months, so an upgrade will be necessary regardless. LTS 12 bundles OpenSearch instead of Elasticsearch, along with up-to-date versions of the relevant libraries.
We therefore recommend upgrading to LTS 12 as the long-term solution.
