# Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j?

**URL:** <https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885>\
**Category:** Elasticsearch\
**Created:** [December 15, 2021, 1:46am UTC](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885 "2021-12-15T01:46:18Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![KidFashion](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kidfashion/32/49135_2.png) [@KidFashion](https://discuss.elastic.co/u/KidFashion)\
**Post date:** [December 15, 2021, 4:56pm UTC](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885/2 "2021-12-15T16:56:32Z")

</div>

Actually it seems they updated the [security announcement](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) to explicitely cover this new vulnerability:

**[Update 15 December]** A further vulnerability (CVE-2021-45046) was disclosed on December 14th after it was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. **Our guidance for Elasticsearch, APM Java Agent, and Logstash are unchanged by this new vulnerability.**

---

_[View the full topic](https://discuss.elastic.co/t/is-elasticsearch-affected-by-cve-2021-45046-a-second-vulnerability-in-log4j/291885)._