Hi , We have recently receive security vulnerabilities related to Log4j , as solution proposed is to Upgrade to Apache Log4j version 2.17.1, 2.12.4, or 2.3.2 or later. Could you please confirm if there is a patch to install in order to fix this vulnerabilities , or is it mandatory to upgrade the…

I have no idea for 3rd party plugins. You should ask them.

We also have on elasticsearch serveurs the vulnerability : 151209 (4) - OpenJDK 7 <= 7u281 / 8 <= 8u272 / 11.0.0 <= 11.0.9 / 13.0.0 <= 13.0.5 / 15.0.0 <= 15.0.1 Vulnerability (2021-01-19) The solution proposed is to upgrade Upgrade to an OpenJDK version greater than 7u281 / 8u272 / 11.0.9 / 13.0.…

As noted earlier, upgrade to at least version 7.17.8. I believe this comes with a considerable more recent JVM bundled.

Apache Log4j 2.0 < 2.3.2 / 2.4 < 2.12.4 / 2.13 < 2.17.1 RCE

Elastic Stack Elasticsearch

khadija70 (khadija) January 20, 2023, 4:57pm 3

Thanks foryour answer , for the pluging readonly rest should we also upgrade it or juste the ELK cluster which must be upgrade

Topic		Replies	Views
151209 (4) - OpenJDK 7 <= 7u281 / 8 <= 8u272 / 11.0.0 <= 11.0.9 / 13.0.0 <= 13.0.5 / 15.0.0 <= 15.0.1 Vulnerability (2021-01-19) Elasticsearch	8	961	February 17, 2023
ELK upgrade to 7.17.10 Elasticsearch	3	230	July 19, 2023
Log4j on Elasticsearch 7.9.2 Elasticsearch	9	3659	February 14, 2022
Regarding log4j vulnerability Elasticsearch docker	5	6575	February 2, 2022
Logstash and elasticsearch bundled java update Elasticsearch	3	402	January 6, 2023

Apache Log4j 2.0 < 2.3.2 / 2.4 < 2.12.4 / 2.13 < 2.17.1 RCE

Related topics