# Delete log4j-api-2.11.1.jar - CVE-2021-44228 - ESA-2021-31 **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [December 13, 2021, 7:53pm UTC](https://discuss.elastic.co/t/delete-log4j-api-2-11-1-jar-cve-2021-44228-esa-2021-31/291711 "2021-12-13T19:53:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Rnx](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Post date:** [December 13, 2021, 7:53pm UTC](https://discuss.elastic.co/t/delete-log4j-api-2-11-1-jar-cve-2021-44228-esa-2021-31/291711/1 "2021-12-13T19:53:31Z")
Hi, yes, the vulnurability... Shell I delete file "log4j-api-2.11.1.jar" from Elasticsearch folder in Linux installation after the package was updated to 7.16.1? The reason to ask is, the server will get several security audits with alarm beeping on this file, so it would be hard to explain its existence. In addition, I am not able to "test" it's deletion by myself yet... Thanks! ---
**Author:** ![Rnx](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Post date:** [December 13, 2021, 8:11pm UTC](https://discuss.elastic.co/t/delete-log4j-api-2-11-1-jar-cve-2021-44228-esa-2021-31/291711/2 "2021-12-13T20:11:06Z")
According to Apache, probably only "core" is affected (not api), however, it would be nice from someone to confirm my endings. [https://logging.apache.org/log4j/2.x/security.html](https://logging.apache.org/log4j/2.x/security.html) file log4j-api-2.11.1.jar - probably not affected, therefore not deleted file log4j-core-2.11.1.jar - affected and deleted (by upgrade procedure) Thanks! ---
**Author:** ![ish1301](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ish1301/32/99137_2.png) [@ish1301](https://discuss.elastic.co/u/ish1301)\ **Post date:** [December 16, 2021, 5:18pm UTC](https://discuss.elastic.co/t/delete-log4j-api-2-11-1-jar-cve-2021-44228-esa-2021-31/291711/3 "2021-12-16T17:18:21Z")
Extract from [https://logging.apache.org/log4j/2.x/security.html](https://logging.apache.org/log4j/2.x/security.html) > Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability. can someone from Elasticsearch team officially confirm this? ---
**Author:** ![Rnx](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Post date:** [December 16, 2021, 6:18pm UTC](https://discuss.elastic.co/t/delete-log4j-api-2-11-1-jar-cve-2021-44228-esa-2021-31/291711/4 "2021-12-16T18:18:16Z")
Based on the official Apache page, api is not affected: #### Mitigation **Log4j 1.x mitigation** : Log4j 1.x is not impacted by this vulnerability. **Log4j 2.x mitigation** : Implement one of the mitigation techniques below. - Java 8 (or later) users should upgrade to release 2.16.0. - Users requiring Java 7 should upgrade to release 2.12.2 when it becomes available (work in progress, expected to be available soon). - Otherwise, remove the JndiLookup class from the classpath: zip -q -d log4j-core-\*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class **Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 13, 2022, 6:18pm UTC](https://discuss.elastic.co/t/delete-log4j-api-2-11-1-jar-cve-2021-44228-esa-2021-31/291711/5 "2022-01-13T18:18:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.