There's an excellent article on Logstash remediation to protect against Log4jshell vulnerability - Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation . However, the steps suggested for Logstash 5.x don't seem to work, especially when using remove_backup_jndi_loo…

On Logstash 5.x.x run vendor/jruby/bin/ruby /tmp/remove_jndi_lookup.rb There's an accidental typo and it should be vendor/jruby/bin/jruby. i.e. instead of ruby it should be jruby. Fixing this throws another error: $ vendor/jruby/bin/jruby /root/remove_backup_jndi_lookup.rb LoadError: no such …

Discuss the Elastic Stack

Bug in Log4j mitigation steps in Logstash 5.x

Elastic Stack Logstash

stephenb (Stephen Brown) December 21, 2021, 8:24pm 3

@sandeepkanabar

Perhaps it was just a typo but The article you linked to is for remediation for elasticsearch.

The correct article for a remediation of logstash 5.x is this

1 Like

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.