CVE-2021-44832

Elastic Stack Elasticsearch
1

HI

I am using Elasticsearch v 7.16.2 version and found CVE-2021-44832 Vurn.
Please help me to update jar file

Plugin Output:
Path : /usr/share/elasticsearch/lib/elasticsearch-log4j-7.16.2.jar
Installed version : 2.17.0
Fixed version : 2.17.1

Path : /usr/share/elasticsearch/bin/elasticsearch-sql-cli-7.16.2.jar
Installed version : 2.17.0
Fixed version : 2.17.1

2

I would reccomend you upgrade Elasticsearch to the latest version rather than try to mess with jar files.

3

HI Christian_Dahlqvist

upgrade Elasticsearch throw error on documents

4

You will need to first upgrade to Elasticsearch 7.17 and run the migration assistant as outlined in the documentation. There should be no compatibility issues doing that. Then you need to address any issues identified by the assistant before migrating to the latest version (if going to 7.17 does not resolve your issue).

5

The only supported way to upgrade jars within Elasticsearch is to upgrade Elasticsearch itself (as @Christian_Dahlqvist has recommended).

There is no safe way to upgrade dependencies on their own and it is entirely possible that you will break your cluster - sometimes in ways that cannot be repaired.

1 Like