# Log4j security vulnerability and plugins which bundle / vendor dependencies **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [December 12, 2021, 10:54am UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-and-plugins-which-bundle-vendor-dependencies/291537 "2021-12-12T10:54:34Z")\ **Posts on this page:** 1\ **Showing post:** 4
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [December 16, 2021, 3:47pm UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-and-plugins-which-bundle-vendor-dependencies/291537/4 "2021-12-16T15:47:05Z")
This is addressed in the [ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) security announcement. More details: - Most plugins rely on log4j-api, which allows the plugins to use log4j provided by the application without providing their own. The log4j-api is not vulnerable to the CVE. - 7.16.1 and 6.8.21 provide log4j-core 2.15, and also both still include an old, _unreachable_ log4j-core in one of their bundled plugins (TCP input). - The jar is unreachable (and therefore not exploitable) because of how plugins are loaded in Logstash, but removing its JNDI lookup class is a safe mechanism to add peace of mind - updated versions of the TCP Input have been released to rely only on log4j-api and will be included in any subsequent patch releases. --- _[View the full topic](https://discuss.elastic.co/t/log4j-security-vulnerability-and-plugins-which-bundle-vendor-dependencies/291537)._