# DockerHub showing Log4Shell vulnerability on supported version

**URL:** <https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [December 16, 2021, 5:29pm UTC](https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202 "2021-12-16T17:29:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cruizba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cruizba/32/76115_2.png) [@cruizba](https://discuss.elastic.co/u/cruizba)\
**Post date:** [December 16, 2021, 5:29pm UTC](https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202/1 "2021-12-16T17:29:18Z")

</div>

Despite [official announcement](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) saying that supported versions of Elasticsearch (6.8.9+, 7.8+) can not be exploited because of Elasticsearch’s usage of the Java Security Manager, dockerhub is showing images as "Log4Shell" detected.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff020e074314f05a9d9226e2da7fd0f09e966daf.png)

I suppose that those Elasticsearch versions are secure because of the official announcement, but due to this global paranoia, it would be nice to clarify explicitly in the announcement that, despite dockerhub showing "Log4Shell" detected, these supported versions are secure.

If not clarified, it would be nice to have a patch version also for versions of Elasticsearch (6.8.9+, 7.8+), because it feels kind of "forced" for users between 7.0 and 7.16, to update to the patched version.

I am not complaining, I'm glad Elasticsearch take such effort on mitigating and patching things, I'm just suggesting because there is a lot of misinformation about Elasticsearch and this specific vulnerability.

Best Regards, and I hope this logpocalipsis ends soon 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 20, 2021, 12:25am UTC](https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202/2 "2021-12-20T00:25:21Z")

</div>

[https://twitter.com/justincormack/status/1471519246811209736](https://twitter.com/justincormack/status/1471519246811209736) is relevant to this, but it looks like Docker is looking after it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2022, 12:26am UTC](https://discuss.elastic.co/t/dockerhub-showing-log4shell-vulnerability-on-supported-version/292202/3 "2022-01-17T00:26:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.