# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=10 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 11 --- ## [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476)
**Author:** [@Levine](https://discuss.elastic.co/u/Levine)\ **Replies:** 4\ **Last updated:** [January 13, 2022, 9:17pm UTC](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476 "2022-01-13T21:17:27Z")
Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 ​​Note - We will update this announcement with new details as they emerge from our analysis. Please chec… --- ## [Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation](https://discuss.elastic.co/t/logstash-5-0-0-6-8-20-and-7-0-0-7-16-0-log4j-cve-2021-44228-cve-2021-45046-remediation/292343)
**Author:** [@RobBavey](https://discuss.elastic.co/u/RobBavey)\ **Replies:** 0\ **Last updated:** [December 17, 2021, 5:05pm UTC](https://discuss.elastic.co/t/logstash-5-0-0-6-8-20-and-7-0-0-7-16-0-log4j-cve-2021-44228-cve-2021-45046-remediation/292343 "2021-12-17T17:05:07Z")
Note — These instructions only apply if you are running Logstash 5.0.0 - 6.8.20, or 7.0.0 - 7.16.0. If you are running an older version of Logstash, or a version of Logstash \>= 6.8.21 in the 6.x series or \>= 7.16.1 in th… --- ## [Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2: Log4j CVE-2021-44228, CVE-2021-45046 remediation](https://discuss.elastic.co/t/elasticsearch-5-0-0-5-6-10-and-6-0-0-6-3-2-log4j-cve-2021-44228-cve-2021-45046-remediation/292054)
**Author:** [@qhoxie](https://discuss.elastic.co/u/qhoxie)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 10:21pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-0-5-6-10-and-6-0-0-6-3-2-log4j-cve-2021-44228-cve-2021-45046-remediation/292054 "2021-12-15T22:21:00Z")
Note — If you are not running Elasticsearch 5.0.0-5.6.10 or 6.0.0-6.3.2, these instructions do not apply. Please follow the guidance in the main announcement. Instructions for removing JndiLookup from the log4j-core JAR… --- ## [APM Java Agent Security Update](https://discuss.elastic.co/t/apm-java-agent-security-update/291355)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 5:25pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/291355 "2021-12-09T17:25:33Z")
APM Java Agent Local Privilege Escalation issue (ESA-2021-30) A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running th… --- ## [APM Java Agent Security Update](https://discuss.elastic.co/t/apm-java-agent-security-update/289627)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [November 18, 2021, 5:41pm UTC](https://discuss.elastic.co/t/apm-java-agent-security-update/289627 "2021-11-18T17:41:52Z")
APM Java Agent Local Privilege Escalation issue (ESA-2021-29) A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with… --- ## [Enterprise Search 7.16.0 Security Update](https://discuss.elastic.co/t/enterprise-search-7-16-0-security-update/291146)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [December 7, 2021, 5:00pm UTC](https://discuss.elastic.co/t/enterprise-search-7-16-0-security-update/291146 "2021-12-07T17:00:36Z")
Enterprise Search Information Disclosure issue (ESA-2021-28) An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integrat… --- ## [Kibana 7.15.2 Security Update](https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 7:18pm UTC](https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923 "2021-11-10T19:18:19Z")
Kibana Path Traversal issue (ESA-2021-26) It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user … --- ## [Elastic Stack 7.14.1 Security Update](https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [September 1, 2021, 4:10pm UTC](https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077 "2021-09-01T16:10:55Z")
Kibana code execution issue (ESA-2021-21) It was discovered that a user with fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded i… --- ## [Elasticsearch 7.13.4 Security Update](https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 3:14pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 "2021-07-20T15:14:29Z")
Elasticsearch memory disclosure issue (ESA-2021-16) A memory disclosure vulnerability was identified in Elasticsearch’s error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit … --- ## [Elastic Stack 7.14.0 Security Update](https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:44pm UTC](https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344 "2021-08-03T15:44:59Z")
Elasticsearch Document/Field Level Security issue (ESA-2021-18) A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated… --- ## [Elastic Cloud Enterprise security update](https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 3:17pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 "2021-07-20T15:17:20Z")
Elastic Cloud Enterprise security update (ESA-2021-17) Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no perm… --- ## [Elasticsearch 7.13.3 and 6.8.17 Security Update](https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [July 7, 2021, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100 "2021-07-07T17:23:56Z")
Elasticsearch Denial of Service issue (ESA-2021-15) An uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submi… --- ## [Elastic APM .NET Agent 1.10.0 Security Update](https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 5:42pm UTC](https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668 "2021-06-01T17:42:39Z")
Elastic APM .NET Agent information disclosure (ESA-2021-14) The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will saniti… --- ## [Elastic Stack 7.13.0 and 6.8.16 Security Update](https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [May 25, 2021, 3:17pm UTC](https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964 "2021-05-25T15:17:07Z")
Kibana url redirection flaw (ESA-2021-12) An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user… --- ## [7.12.1 Security Update](https://discuss.elastic.co/t/7-12-1-security-update/271433)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 7:28pm UTC](https://discuss.elastic.co/t/7-12-1-security-update/271433 "2021-04-27T19:28:03Z")
Kibana denial of service issue (ESA-2021-10) A denial of service vulnerability was found in the Kibana webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webh… --- ## [Elastic Stack 7.12.0 and 6.8.15 Security Update](https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 5:40pm UTC](https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 "2021-03-23T17:40:24Z")
Elasticsearch Suggester & Profile API information disclosure flaw (ESA-2021-06) A document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The… --- ## [Elastic Stack 7.11.0 Security Update](https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [March 1, 2021, 4:55pm UTC](https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835 "2021-03-01T16:55:42Z")
Elasticsearch field disclosure flaw (ESA-2021-05) A document disclosure flaw was found in Elasticsearch when Document or Field Level Security is used. Get requests do not properly apply security permissions when executi… --- ## [Elastic Stack 7.11.0 and 6.8.14 Security Update](https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [February 10, 2021, 5:50pm UTC](https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915 "2021-02-10T17:50:33Z")
Elasticsearch information disclosure (ESA-2021-03) Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit\_request\_body option is enabled. The Elasticsearch a… --- ## [Elastic APM Agent for Go 1.11.0 Security Update](https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 2:19pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252 "2021-02-04T14:19:59Z")
Elastic APM Agent for Go information disclosure (ESA-2021-02) The Elastic APM agent for Go can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sa… --- ## [Elasticsearch 7.10.2 Security Update](https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 6:09pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164 "2021-01-14T18:09:21Z")
Elasticsearch authorization-header storage issue (ESA-2021-01) An information disclosure flaw was found in the Elasticsearch async search API. Users who execute an async search will store the HTTP headers. An Elasticsea… --- ## [Beats 7.10.1 Security Update](https://discuss.elastic.co/t/beats-7-10-1-security-update/258160)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 4:24pm UTC](https://discuss.elastic.co/t/beats-7-10-1-security-update/258160 "2020-12-09T16:24:56Z")
Beats Denial of Service issue (ESA-2020-16) A denial of service flaw when parsing malformed TLS public keys was discovered in Go, the language used to implement Beats. If Beats is configured to listen for Syslog over TL… --- ## [Elastic Stack 7.9.3 and 6.8.13 Security Update](https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [October 22, 2020, 3:34pm UTC](https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033 "2020-10-22T15:34:06Z")
Elasticsearch field disclosure flaw (ESA-2020-13) A document disclosure flaw was found in Elasticsearch when Document or Field Level Security is used. Search queries do not properly preserve security permissions when ex… --- ## [Elastic Stack 6.8.9 and 7.7.0 security update](https://discuss.elastic.co/t/elastic-stack-6-8-9-and-7-7-0-security-update/235571)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 2:14pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-9-and-7-7-0-security-update/235571 "2020-06-03T14:14:53Z")
Kibana upgrade assistant prototype pollution flaw (ESA-2020-05) Kibana versions between 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privi… --- ## [Enterprise Search 7.9.0 security update](https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 3:16pm UTC](https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457 "2020-08-18T15:16:01Z")
Enterprise Search credential exposure flaw (ESA-2020-11) Elastic Enterprise Search versions before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ‘developer’ role, they will… --- ## [Elastic Stack 7.9.0 and 6.8.12 Security Update](https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 3:11pm UTC](https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456 "2020-08-18T15:11:54Z")
Elasticsearch field disclosure flaw (ESA-2020-12) A field disclosure flaw was found in Elasticsearch when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user … --- ## [Elastic Stack 6.8.11 and 7.8.1 security update](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [July 27, 2020, 5:09pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-11-and-7-8-1-security-update/242786 "2020-07-27T17:09:12Z")
Kibana regular expression denial of service flaw (ESA-2020-09) Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana use… --- ## [Elastic Stack 7.7.1 and 6.8.10 Security Update](https://discuss.elastic.co/t/elastic-stack-7-7-1-and-6-8-10-security-update/235573)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 2:16pm UTC](https://discuss.elastic.co/t/elastic-stack-7-7-1-and-6-8-10-security-update/235573 "2020-06-03T14:16:42Z")
Kibana cross site scripting (XSS) issue (ESA-2020-08) The TSVB visualization in Kibana contains a stored XSS flaw. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensit… --- ## [Enterprise Search 7.7.0 security update](https://discuss.elastic.co/t/enterprise-search-7-7-0-security-update/232505)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [May 13, 2020, 7:40pm UTC](https://discuss.elastic.co/t/enterprise-search-7-7-0-security-update/232505 "2020-05-13T19:40:02Z")
Elastic App Search Cross Site Scripting flaw (ESA-2020-04) Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI inject… --- ## [Elastic Cloud on Kubernetes 1.1.0 security update](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-1-1-0-security-update/230221)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 5:23pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-1-1-0-security-update/230221 "2020-04-28T17:23:35Z")
Elastic Cloud on Kubernetes insecure password generation (ESA-2020-03) Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determi… --- ## [Elastic Stack 6.8.8 and 7.6.2 security update](https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920)
**Author:** [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Replies:** 0\ **Last updated:** [March 31, 2020, 5:08pm UTC](https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920 "2020-03-31T17:08:34Z")
Elasticsearch API key privilege escalation (ESA-2020-02) Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is ab… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=9) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=11)