# CVE-2021-44228 aka log4shell is logstash and/or elasticsearch affected? **URL:** \ **Category:** Logstash\ **Created:** [December 10, 2021, 11:07am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415 "2021-12-10T11:07:13Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![jzandbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jzandbergen/32/98677_2.png) [@jzandbergen](https://discuss.elastic.co/u/jzandbergen)\ **Post date:** [December 10, 2021, 11:07am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/1 "2021-12-10T11:07:13Z")
Hi All, I was wondering if logstash and/or Elasticsearch is affected by this CVE? More information about this zeroday can be found here: [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package | LunaSec](https://www.lunasec.io/docs/blog/log4j-zero-day/) I'm not too sure whether or not we're affected so in the meantime we've shutdown all our logstash instances. Cheers! ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [December 10, 2021, 11:24am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/2 "2021-12-10T11:24:12Z")
I just came here to ask the same question. Another link with details: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) ---
**Author:** ![esorek](https://avatars.discourse-cdn.com/v4/letter/e/7ba0ec/32.png) [@esorek](https://discuss.elastic.co/u/esorek)\ **Post date:** [December 10, 2021, 11:52am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/3 "2021-12-10T11:52:49Z")
Same question as well. Please elaborate the list affected and not affected versions ---
**Author:** ![jzandbergen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jzandbergen/32/98677_2.png) [@jzandbergen](https://discuss.elastic.co/u/jzandbergen)\ **Post date:** [December 10, 2021, 2:00pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/4 "2021-12-10T14:00:32Z")
Here I see that a version of Elasticsearch seems to be affected [GitHub - YfryTchsGD/Log4jAttackSurface](https://github.com/YfryTchsGD/Log4jAttackSurface) . ---
**Author:** ![esorek](https://avatars.discourse-cdn.com/v4/letter/e/7ba0ec/32.png) [@esorek](https://discuss.elastic.co/u/esorek)\ **Post date:** [December 10, 2021, 2:23pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/5 "2021-12-10T14:23:42Z")
Not sure it is clear to me and I follow which Elasticsearch versions are affected and which are not. ---
**Author:** ![inazo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inazo/32/96500_2.png) [@inazo](https://discuss.elastic.co/u/inazo)\ **Post date:** [December 10, 2021, 2:38pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/6 "2021-12-10T14:38:02Z")
Search on your host which version are used by Elasticsearch mine is log4j-api-2.11.1.jar what are locate to : /usr/share/Elasticsearch/lib/log4j-api-2.11.1.jar You can add this : **-Dlog4j2.formatMsgNoLookups=true** At the end of **/etc/Elasticsearch/jvm.options** file, for waiting update to 2.15.0 of log4j2 ---
**Author:** ![hocho](https://avatars.discourse-cdn.com/v4/letter/h/8e7dd6/32.png) [@hocho](https://discuss.elastic.co/u/hocho)\ **Post date:** [December 10, 2021, 3:07pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/7 "2021-12-10T15:07:45Z")
Is it not enough to add ` log4j.formatMsgNoLookup = true` in `/etc/elasticsearch/log4j2.properties`? ---
**Author:** ![prprt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prprt/32/34704_2.png) [@prprt](https://discuss.elastic.co/u/prprt)\ **Post date:** [December 10, 2021, 5:10pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/8 "2021-12-10T17:10:14Z")
Has anyone from Elastic confirmed these methods? ---
**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Post date:** [December 10, 2021, 5:19pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/9 "2021-12-10T17:19:02Z")
Just an FYI; [bump log4j version to 2.15.0 by jsvd · Pull Request #13494 · elastic/logstash (github.com)](https://github.com/elastic/logstash/pull/13494) was just merged, so looks like logstash 7.16.1 will contain the new fixed version. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 10, 2021, 10:22pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/10 "2021-12-10T22:22:21Z")
Please see [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476). We will be making more announcements as details become clearer. ---
**Author:** ![Jamshid](https://avatars.discourse-cdn.com/v4/letter/j/ecd19e/32.png) [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Post date:** [December 12, 2021, 4:32pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/11 "2021-12-12T16:32:54Z")
> [@hocho](#): > > Is it not enough to add ` log4j.formatMsgNoLookup = true` in `/etc/elasticsearch/log4j2.properties` ? @hocho where have you seen that this can be specified in **log4j2.properties**? I don't think it can, it must be a system property specified on the jvm command line e.g. in **jvm.options** as **-Dlog4j2.formatMsgNoLookups=true**. ---
**Author:** ![mouarg](https://avatars.discourse-cdn.com/v4/letter/m/48db29/32.png) [@mouarg](https://discuss.elastic.co/u/mouarg)\ **Post date:** [December 13, 2021, 1:42am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/12 "2021-12-13T01:42:47Z")
k: [xxxx.xxx-oob] =\> { ``` "response.stdout_lines": [ "/opt/xxx/xxx/elasticsearch7_2.0.6-es7.9.3_1/data/config/log4j2.properties", "/opt/xxx/xxx/elasticsearch_1.1.55.2-es5.6.8-2_0/data/config/log4j2.properties" ] ``` Do i need to be worried with these versions of Elasticsearch? Thanks ---
**Author:** ![MChat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mchat/32/46467_2.png) [@MChat](https://discuss.elastic.co/u/MChat)\ **Post date:** [December 13, 2021, 6:20pm UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/13 "2021-12-13T18:20:02Z")
As per Solutions and Mitigations for Logstash on Elastic security announcement - [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) , suggests removing JndiLookup class from log4J-core-2\* . **Solutions and Mitigations:** Users should upgrade to Logstash 6.8.21 or 7.16.1 once they are released (expected Monday 13th December). These releases will replace vulnerable versions of Log4j with Log4j 2.15.0. The widespread flag `-Dlog4j2.formatMsgNoLookups=true` is NOT sufficient to mitigate the vulnerability in Logstash in all cases, as Logstash uses Log4j in a way where the flag has no effect. It is therefore necessary to remove the JndiLookup class from the log4j2 core jar, with the following command: `zip -q -d /logstash-core/lib/jars/log4j-core-2.* org/apache/logging/log4j/core/lookup/JndiLookup.class` Please note that a restart of the Logstash process is necessary for the change to take effect. Does it apply to Logstash running on JDK 8u302 with JVM argument, "-Dlog4j2.formatMsgNoLookups=true" without updating log4j-core v2.15 ? This blog [Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package | LunaSec](https://www.lunasec.io/docs/blog/log4j-zero-day/) says - _ **JDK versions greater than `6u211` , `7u201` , `8u191` , and `11.0.1` are not affected by the LDAP attack vector. In these versions `com.sun.jndi.ldap.object.trustURLCodebase` is set to `false` meaning JNDI cannot load remote code using LDAP.** _ ---
**Author:** ![kasune](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@kasune](https://discuss.elastic.co/u/kasune)\ **Post date:** [December 14, 2021, 10:31am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/14 "2021-12-14T10:31:38Z")
As per announcement , **Logstash** Exposure to remote code execution on JDKs prior to 8u191. On newer versions of JDKs there is exposure to Denial of Service and information leakage. Requires JndiLookup class removal or update to Logstash version 6.8.21 or 7.16.1 when released on December 13th. _Additional details below._ Is this means we do not need to update to new versions(6.8.21,7.16.1) if we can update java version and removal of JndiLookup class? I am asking this as we are using ES 5.5.0 with Logstash5.50. If we need to update the logstash to newer version we need to update ES to 6.x.x. And our ES cluster is in TBs. ---
**Author:** ![Ravi\_GH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravi_gh/32/71311_2.png) [@Ravi\_GH](https://discuss.elastic.co/u/Ravi_GH)\ **Post date:** [December 15, 2021, 6:22am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/15 "2021-12-15T06:22:09Z")
With respect to "Incomplete fix for Apache Log4j vulnerability" @ [Incomplete fix for Apache Log4j vulnerability · CVE-2021-45046 · GitHub Advisory Database · GitHub](https://github.com/advisories/GHSA-7rjr-3q55-vv33) Q1) is JndiLookup class removal break any functionality of Logstash? ( in other words is it safe to remove JndiLookup class file? ) Q2) As per info "On recent JDKs the attack is limited to DoS - causing data ingestion to temporarily stop - and information leakage" . What is the recommendation to mitigate this DoS attack? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 12, 2022, 6:23am UTC](https://discuss.elastic.co/t/cve-2021-44228-aka-log4shell-is-logstash-and-or-elasticsearch-affected/291415/16 "2022-01-12T06:23:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.