Logstash 7.17 update OpenJDK to 11.0.17

Elastic Stack Logstash
1

Is Logstash 7.17 still maintained and is there a plan to upgrade the built-in JDK to 11.0.17? This fixes various CVEs for those of us unable to upgrade to logstash 8.4 at this time.

https://openjdk.org/groups/vulnerability/advisories/2022-10-18

Thanks.

2

My reading of the EOL policy is that 7.17.x (but nothing earlier) is supported until 9.0 is released. I cannot speak to Elastic's intent to upgrade the JDK, but can install your own JDK to get the fixes.

3

Would be great if anybody on the logstash team could have a look at this as the bundled JDK has started to show up on security scans, such as this nessus vulnerability.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.