Log4j vulnerability in Elastic Search 7.16.1

Elastic Stack Elasticsearch
1

Hi,

Our vulnerability scanning tool is detecting Elasticsearch-sql-cli-7.16.1.jar in the bin folder as vulnerable and the jar file contains a Jndilookup.class file. Is it supposed to be detected as vulnerable?

Can anyone please advise?

Thank you,

Oliver

2

Please read through Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 and let us know if you have any questions after that

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.