# CVE-2021-44832

**URL:** <https://discuss.elastic.co/t/cve-2021-44832/364592>\
**Category:** Elasticsearch\
**Created:** [August 8, 2024, 9:48am UTC](https://discuss.elastic.co/t/cve-2021-44832/364592 "2024-08-08T09:48:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nishant\_goyal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nishant_goyal/32/136364_2.png) [@nishant\_goyal](https://discuss.elastic.co/u/nishant_goyal)\
**Post date:** [August 8, 2024, 9:48am UTC](https://discuss.elastic.co/t/cve-2021-44832/364592/1 "2024-08-08T09:48:29Z")

</div>

HI

I am using Elasticsearch v 7.16.2 version and found CVE-2021-44832 Vurn.  
Please help me to update jar file

Plugin Output:  
Path : /usr/share/elasticsearch/lib/elasticsearch-log4j-7.16.2.jar  
Installed version : 2.17.0  
Fixed version : 2.17.1

Path : /usr/share/elasticsearch/bin/elasticsearch-sql-cli-7.16.2.jar  
Installed version : 2.17.0  
Fixed version : 2.17.1

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 8, 2024, 9:53am UTC](https://discuss.elastic.co/t/cve-2021-44832/364592/2 "2024-08-08T09:53:14Z")

</div>

I would reccomend you upgrade Elasticsearch to the latest version rather than try to mess with jar files.

---

<div class="post-metadata">

**Author:** ![nishant\_goyal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nishant_goyal/32/136364_2.png) [@nishant\_goyal](https://discuss.elastic.co/u/nishant_goyal)\
**Post date:** [August 8, 2024, 9:56am UTC](https://discuss.elastic.co/t/cve-2021-44832/364592/3 "2024-08-08T09:56:39Z")

</div>

HI Christian\_Dahlqvist

upgrade Elasticsearch throw error on documents

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 8, 2024, 10:01am UTC](https://discuss.elastic.co/t/cve-2021-44832/364592/4 "2024-08-08T10:01:20Z")

</div>

> [@nishant\_goyal](#):
>
> upgrade Elasticsearch throw error on documents

You will need to first upgrade to Elasticsearch 7.17 and run the migration assistant [as outlined in the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-upgrade.html). There should be no compatibility issues doing that. Then you need to address any issues identified by the assistant before migrating to the latest version (if going to 7.17 does not resolve your issue).

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 9, 2024, 12:15am UTC](https://discuss.elastic.co/t/cve-2021-44832/364592/5 "2024-08-09T00:15:26Z")

</div>

The only supported way to upgrade jars within Elasticsearch is to upgrade Elasticsearch itself (as @Christian_Dahlqvist has recommended).

There is no safe way to upgrade dependencies on their own and it is entirely possible that you will break your cluster - sometimes in ways that cannot be repaired.