There's an excellent article on Logstash remediation to protect against Log4jshell vulnerability - Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation . However, the steps suggested for Logstash 5.x don't seem to work, especially when using remove_backup_jndi_loo…

On Logstash 5.x.x run vendor/jruby/bin/ruby /tmp/remove_jndi_lookup.rb There's an accidental typo and it should be vendor/jruby/bin/jruby. i.e. instead of ruby it should be jruby. Fixing this throws another error: $ vendor/jruby/bin/jruby /root/remove_backup_jndi_lookup.rb LoadError: no such …

Bug in Log4j mitigation steps in Logstash 5.x

Elastic Stack Logstash

stephenb (Stephen Brown) December 21, 2021, 8:24pm 3

@sandeepkanabar

Perhaps it was just a typo but The article you linked to is for remediation for elasticsearch.

The correct article for a remediation of logstash 5.x is this

1 Like

Topic		Replies	Views
Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation Security Announcements docker	1	13304	November 4, 2022
Logstash 7.x Log4j CVE remediation on Windows server Logstash docker	1	221	October 17, 2023
Log4j2 vulnerability mitigation - JndiLookup Removal Logstash	2	325	July 4, 2023
Log4j security vulnerability for logstash 6.2.2 Logstash	1	940	February 9, 2022
Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2: Log4j CVE-2021-44228, CVE-2021-45046 remediation Security Announcements	1	32547	November 4, 2022

Bug in Log4j mitigation steps in Logstash 5.x

Related topics