A flaw in Kibana’s session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out. References: https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125
Statement: In OpenShift Container Platform (OCP) the kibana components have X-Pack security features disabled by default. The X-Pack plugin can be used only is an enterprise version [1]. Hence the open source version is unaffected by this vulnerability. [1] https://www.elastic.co/subscriptions
Cluster Logging does not ship Kibana with X-Pack installed, not just disabled, it isn't even able to be turned on.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-22136
External References: https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125