# CVE-2021-45105 and CVE-2020-9488 vulnerabilities with java apm agent 1.28.4

**URL:** https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766
**Category:** APM
**Tags:** java
**Created:** [January 19, 2022, 5:20am UTC](https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766 "2022-01-19T05:20:49Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![vin89](https://avatars.discourse-cdn.com/v4/letter/v/34f0e0/32.png) [@vin89](https://discuss.elastic.co/u/vin89)
#### Post date: [January 19, 2022, 5:20am UTC](https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766/1 "2022-01-19T05:20:49Z")

</div>

After we upgraded to java apm agent version to 1.28.4 from 1.23.0 there were 2 vulnerabilities newly added

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/0/90a33c9968da2a30e49e135cefe82ebba8c2f631.png)

And as I see in 1.28.4 version i could see log4j version being used is 2.12.4, so is there any plan to upgrade it 2.17.0 version or any workaround to mitigate these vulnerabilities as these are being picked by application scans

---

<div class="post-metadata">

### Author: ![felixbarny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixbarny/32/27341_2.png) [@felixbarny](https://discuss.elastic.co/u/felixbarny)
#### Post date: [January 19, 2022, 7:10am UTC](https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766/3 "2022-01-19T07:10:52Z")

</div>

Log4j 2.12.4, which is used in the Elastic APM Java Agent 1.28.4 addresses these vulnerabilities.

See also [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#apm-java-agent-announcement-esa-2021-31-21) and [Log4j – Apache Log4j Security Vulnerabilities](https://logging.apache.org/log4j/2.x/security.html).

If your vulnerability scanner doesn't detect that Log4j 2.12.4/Elastic APM Java Agent 1.28.4 contains fixes to these CVEs, please get in touch with the vendor of this scanner so that they can update their policies.

---

<div class="post-metadata">

### Author: ![felixbarny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixbarny/32/27341_2.png) [@felixbarny](https://discuss.elastic.co/u/felixbarny)
#### Post date: [January 19, 2022, 7:35am UTC](https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766/4 "2022-01-19T07:35:41Z")

</div>

The reason we can't update to Log4j 2.17.0 is that this version doesn't support Java 7. As the Java agent still does support Java 7, we're using the latest 1.12.x version which contains all the security fixes.

---

<div class="post-metadata">

### Author: ![vin89](https://avatars.discourse-cdn.com/v4/letter/v/34f0e0/32.png) [@vin89](https://discuss.elastic.co/u/vin89)
#### Post date: [January 19, 2022, 7:53am UTC](https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766/6 "2022-01-19T07:53:23Z")

</div>

@felixbarny thank you for your response.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 9, 2022, 3:53am UTC](https://discuss.elastic.co/t/cve-2021-45105-and-cve-2020-9488-vulnerabilities-with-java-apm-agent-1-28-4/294766/7 "2022-02-09T03:53:36Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.