# Log4j vulnerability and Elasticsearch 6.8.21
**URL:** https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088
**Category:** Elasticsearch
**Created:** [December 16, 2021, 6:59am UTC](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088 "2021-12-16T06:59:21Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@srikanth.puli](https://discuss.elastic.co/u/srikanth.puli)
#### Post date: [December 16, 2021, 6:59am UTC](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088/1 "2021-12-16T06:59:21Z")
Hi,
As per the release notes of Elasticserch 6.8.21, the vulnerability [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228) is addressed by removing the class file JndiLookup.class from the log4j jar. We have upgraded our application with Elasticsearch 6.8.21 and I see the class file is removed from log4j jar. However I found another JndiLookup.class in the jar file Elasticsearch-sql-cli-6.8.21.jar?
doesn't it make the vulnerability alive?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 13, 2022, 7:00am UTC](https://discuss.elastic.co/t/log4j-vulnerability-and-elasticsearch-6-8-21/292088/2 "2022-01-13T07:00:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.