# Elastic Diagnostics and Log4j2 vulnerability

**URL:** <https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808>\
**Category:** Elasticsearch\
**Created:** [January 8, 2022, 4:54pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808 "2022-01-08T16:54:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![newschapmj1](https://avatars.discourse-cdn.com/v4/letter/n/dbc845/32.png) [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\
**Post date:** [January 8, 2022, 4:54pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808/1 "2022-01-08T16:54:19Z")

</div>

Does upgrading to 8.2.6 fix all known Log4j2 issues with Elastic Diagnostics?

> **[Release Support Diagnostic v8.2.6 · elastic/support-diagnostics](https://github.com/elastic/support-diagnostics/releases/tag/v8.2.6)**
>
> What's Changed
> 
> \[Dependency\] Upgrade Log4j2 to 2.17.0 by @octavioranieri in #559
> 
> Full Changelog: 8.2.5...v8.2.6

Should it be on the Elastic list of software affected by Log4j2 to remind users to upgrade?

> [@Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476):
>
> Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 ​​Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary: ECK 1.9 released which automatically adds the JVM option to impacted Elasticsearch clusters managed by ECK. Dec 17, 2021 - 23:50 UTC - Update latest release of APM Java Agent to 1.28.2. Statement of pl…

> **[Apache Logging Services](https://logging.apache.org/security.html)**

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 9, 2022, 9:31pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808/2 "2022-01-09T21:31:33Z")

</div>

This is not a product that we support in the same way as we would the Elastic Stack, so it's not going to be listed in the main announcement, no.

There will likely be an upgrade to it with the new library, yes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2022, 9:32pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808/3 "2022-02-06T21:32:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.