# Log4j CVE-2021-44832 (released 28th dec) - is ES vulnerable?

**URL:** <https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076>\
**Category:** Elasticsearch\
**Created:** [December 29, 2021, 12:08am UTC](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076 "2021-12-29T00:08:36Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

**Author:** ![jeansalama](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeansalama/32/99721_2.png) [@jeansalama](https://discuss.elastic.co/u/jeansalama)\
**Post date:** [January 10, 2022, 9:04pm UTC](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076/10 "2022-01-10T21:04:20Z")

</div>

[They said](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476#update-jan-6-4) that there is no known vulnerabilities :

> By default, Elasticsearch and Logstash have **no known vulnerabilities** to this as **relevant configuration files are only writable by cluster administrators**. We will release 7.16.3 and 6.8.23 to update Log4j to 2.17.1, targeting Jan 13.

---

_[View the full topic](https://discuss.elastic.co/t/log4j-cve-2021-44832-released-28th-dec-is-es-vulnerable/293076)._