# Elastic-apm-agent-1.33.0.jar flagged by security scan
**URL:** https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369
**Category:** APM
**Tags:** java
**Created:** [February 23, 2023, 7:36pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369 "2023-02-23T19:36:24Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@tonyk](https://discuss.elastic.co/u/tonyk)
#### Post date: [February 23, 2023, 7:36pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369/1 "2023-02-23T19:36:24Z")
Our internal security team is running a scanning tool that is flagging the apm-agent-1.33.0.jar file as being insecure and vulnerable for the log4j vulnerability (CVE-2021-44228). In further investigation they found the apm-agent-java has a dependency on log4j 2.12.4 which is impacted by the vulnerability CVE-2021-44228.
Here is the link to the Elastic git code showing the dependency: [apm-agent-java/pom.xml at main · elastic/apm-agent-java · GitHub](https://github.com/elastic/apm-agent-java/blob/main/pom.xml#L125)
Can someone please verify if there are vulnerabilities with this version of the apm-agent that we should address. Thank you
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [February 23, 2023, 7:49pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369/2 "2023-02-23T19:49:16Z")
Thank you for your report.
Elastic's security reporting guidelines are available at [Security issues | Elastic](https://www.elastic.co/community/security).
Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to [security@elastic.co](mailto:security@elastic.co).
We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.
---
### Author:  [@tonyk](https://discuss.elastic.co/u/tonyk)
#### Post date: [February 23, 2023, 10:19pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369/3 "2023-02-23T22:19:03Z")
Ok, I will send an email. Thank you for the information. This issue can be closed.
---
### Author:  [@Eyal\_Koren](https://discuss.elastic.co/u/Eyal_Koren)
#### Post date: [February 24, 2023, 7:14am UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369/4 "2023-02-24T07:14:04Z")
This is probably a false finding - see [log4j history review](https://logging.apache.org/log4j/2.x/security.html) and more info in our [FAQ](https://www.elastic.co/guide/en/apm/agent/java/current/faq.html#faq-log4j2-security).
If there’s a new vulnerability that’s not yet patched in the latest version of the Elastic APM Java Agent, please report as @dadoonet describes.
---
### Author:  [@Jack\_Shirazi](https://discuss.elastic.co/u/Jack_Shirazi)
#### Post date: [February 24, 2023, 9:23am UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369/5 "2023-02-24T09:23:35Z")
[https://logging.apache.org/log4j/2.x/security.html#fixed-in-log4j-2-17-1-java-8-2-12-4-java-7-and-2-3-2-java-6](https://logging.apache.org/log4j/2.x/security.html#fixed-in-log4j-2-17-1-java-8-2-12-4-java-7-and-2-3-2-java-6)
2.12.4 is not vulnerable to CVE-2021-44228
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 24, 2023, 9:24am UTC](https://discuss.elastic.co/t/elastic-apm-agent-1-33-0-jar-flagged-by-security-scan/326369/6 "2023-03-24T09:24:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.