Hi All, I was wondering if logstash and/or Elasticsearch is affected by this CVE? More information about this zeroday can be found here: Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package | LunaSec I'm not too sure whether or not we're affected so in the meantime we've …

CVE-2021-44228 aka log4shell is logstash and/or elasticsearch affected?

BenB196 (Ben B196) December 10, 2021, 5:19pm 9

Just an FYI; bump log4j version to 2.15.0 by jsvd · Pull Request #13494 · elastic/logstash (github.com) was just merged, so looks like logstash 7.16.1 will contain the new fixed version.

3 Likes

Log4j Critical Vulnerability

Topic		Replies	Views
Does Log4j vulnerability (CVE-2021-44228) is impacted for ES v7.5.2? Elasticsearch	2	1268	January 17, 2022
Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j? Elasticsearch	2	5951	January 12, 2022
Logstash is affected by Apache Log4j2 2.17.0 Vulnerability CVE-2021-44832? Logstash	4	2417	February 3, 2022
Log4j CVE-2021-44832 (released 28th dec) - is ES vulnerable? Elasticsearch	10	6637	February 7, 2022
When will the next patch be released for Elasticsearch Elasticsearch	8	1624	January 17, 2022