# Log4j security vulnerability for logstash 6.2.2
**URL:** https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205
**Category:** Logstash
**Created:** [January 12, 2022, 8:46pm UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205 "2022-01-12T20:46:46Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ellje](https://discuss.elastic.co/u/ellje)
#### Post date: [January 12, 2022, 8:46pm UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205/1 "2022-01-12T20:46:46Z")
Hi,
I'm using an older version of Logstash (6.2.2) and I cannot migrate it just yet. In the meantime, I read that to remediate the log4j issue, we should be removing the jndi class as noted in [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) where I should use instructions here [Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation](https://discuss.elastic.co/t/logstash-5-0-0-6-8-20-and-7-0-0-7-16-0-log4j-cve-2021-44228-cve-2021-45046-remediation/292343)
I've done all that, but the Wiz security tool that I'm using is picking up packages like
**/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-kafka-7.0.8/lib/org/apache/logging/log4j/log4j-core/2.6.2/log4j-core-2.6.2.jar**
which **wasn't** noted in the instructions. Is this still going to pose an issue? What about the maven dependencies like **/root/.m2/repository/log4j-core-2.6.2.jar**? Would I be able to simply remove these maven dependencies?
Any advice is much appreciated, thank you in advanced for your time and let me know if there are additional information that would be helpful
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 9, 2022, 8:46pm UTC](https://discuss.elastic.co/t/log4j-security-vulnerability-for-logstash-6-2-2/294205/2 "2022-02-09T20:46:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.