Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31

Levine · January 13, 2022, 9:17pm

ESA-2021-31 Advisory Updated

Jan 13, 2022 21:00 UTC - Elasticsearch, Logstash 7.16.3 and 6.8.23 are released, which upgrade log4j to 2.17.1. Note about ECE and Apache Zookeeper.

Elasticsearch, Logstash 7.16.3 and 6.8.23 are released, which upgrade log4j to 2.17.1. By default, Elasticsearch and Logstash have no known vulnerabilities to CVE-2021-44832.

ECE uses Apache Zookeeper which depends on log4j 1.2.17 as an internal dependency. There is no known exploitation of CVE-2021-4104 in this implementation, and there are currently no upstream plans announced by the Apache Zookeeper project to update the log4j version in Zookeeper.

Topic		Replies	Views
CVE-2021-45105 and CVE-2020-9488 vulnerabilities with java apm agent 1.28.4 APM java	4	1631	February 9, 2022
When will the next patch be released for Elasticsearch Elasticsearch	8	1628	January 17, 2022
Elastic Diagnostics and Log4j2 vulnerability Elasticsearch	2	1028	February 6, 2022
How do I Mitigate LOG4J CVE on Elasticsearch 7.4.0? Elasticsearch	3	614	January 4, 2023
Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j? Elasticsearch	2	5954	January 12, 2022

Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31

Related topics