Search Guard Security Fixes: FLS/DLS Bugs, TLS 1.0/1.1 Deprecation

Critical Vulnerability Information Breaking Changes Removed the Bouncy Castle Security Provider: Search Guard now defaults to using Java Cryptography Extensions (JCE) for cryptographic functionality. This may affect TLS connections, JWT signature verification, authentication with OIDC and SAML, and other cryptographic operations. Removed Legacy Configuration Format: Support for has been removed in favor of . TLS on the REST Layer Enabled by Default: TLS is enabled by default on the REST layer with the new configuration parameter. Action Groups Attribute is Mandatory: The attribute in action groups is now mandatory. Audit Log Bulk Request Body Logging is Disabled by Default: The new configuration parameter is introduced to control logging of bulk request bodies. Support for TLS 1.0 and TLS 1.1 Has Been Dropped: Support for outdated and insecure TLS 1.0 and TLS 1.1 protocols has been removed. Security Fixes FLS Rules Fix: FLS rules that grant access to object subfields now function correctly. Async Search Status: Support for asynchronous search status request functionality has been added. LDAP - TLS Setup Improvements: Enhanced detection and handling of mixed LDAP:// and LDAPS:// host configurations. sgctl Fixes: A bug that occurred during user creation with uncommon characters in the username has been corrected. DLS Role Parsing Bug Fix: A bug where DLS rules were not applied when Signal’s watch was executing has been fixed.

Goal Reached Thanks to every supporter — we hit 100%!

Search Guard Security Fixes: FLS/DLS Bugs, TLS 1.0/1.1 Deprecation