As the title states, is Elasticsearch vulnerable for the new Log4j vulnerability CVE-2021-44832 ? This is a new vulnerability of which the details were released a few hours ago. Or is this prevented by the security manager?

Log4j CVE-2021-44832 (released 28th dec) - is ES vulnerable?

jeansalama (Jean Salama) January 10, 2022, 9:04pm 10

They said that there is no known vulnerabilities :

By default, Elasticsearch and Logstash have no known vulnerabilities to this as relevant configuration files are only writable by cluster administrators. We will release 7.16.3 and 6.8.23 to update Log4j to 2.17.1, targeting Jan 13.

Topic		Replies	Views
Does Log4j vulnerability (CVE-2021-44228) is impacted for ES v7.5.2? Elasticsearch	2	1270	January 17, 2022
Log4j on Elasticsearch 7.9.2 Elasticsearch	9	3375	February 14, 2022
Is Elasticsearch affected by CVE-2021-45046 - a second vulnerability in log4j? Elasticsearch	2	5954	January 12, 2022
How do I Mitigate LOG4J CVE on Elasticsearch 7.4.0? Elasticsearch	3	614	January 4, 2023
When will the next patch be released for Elasticsearch Elasticsearch	8	1628	January 17, 2022

Log4j CVE-2021-44832 (released 28th dec) - is ES vulnerable?

Related topics