How do I Mitigate LOG4J CVE on Elasticsearch 7.4.0?

Elastic Stack Elasticsearch
1

I have a 3-node ELK cluster in linux. Carbon Black scan picked up some vulnerable jar files. Should I:

  1. Upgrade Elasticsearch to 7.16 or later ?
  2. Remove the vulnerable JAR files ?
  3. Upgrade LOG4J components bundled in Elastic ad-hoc (to LOG4J2?)
2

Elasticsearch 7.4 is EOL and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

3

Please Refer to the Official Thread on this.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.