# Logstash using vulnerable JDK **URL:** \ **Category:** Logstash\ **Created:** [August 27, 2021, 4:22am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623 "2021-08-27T04:22:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Aditya931](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Aditya931](https://discuss.elastic.co/u/Aditya931)\ **Post date:** [August 27, 2021, 4:22am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/1 "2021-08-27T04:22:13Z")
Hi, The latest logstash (7.14.0) is using a vulnerable jdk, and we've got number of security issues because of that. Below is the version of logstash and the jdk used by it. Any update on when will this be resolved? and if any steps which can be used to upgrade the vulnerable jdk shipped with logstash. Below are the CVE issues reported on this version of jdk. CVE-2021-2341,CVE-2021-2388,CVE-2021-2432,CVE-2021-2369 **/usr/share/logstash/jdk/bin/java --version** **openjdk 11.0.11 2021-04-20** **OpenJDK Runtime Environment AdoptOpenJDK-11.0.11+9 (build 11.0.11+9)** **OpenJDK 64-Bit Server VM AdoptOpenJDK-11.0.11+9 (build 11.0.11+9, mixed mode)** \*\* /usr/share/logstash/bin/logstash -V\*\* **Using JAVA\_HOME defined java: /usr/lib/jvm/java-11-openjdk-amd64** **WARNING, using JAVA\_HOME while Logstash distribution comes with a bundled JDK** **logstash 7.14.0** ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 27, 2021, 4:27am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/2 "2021-08-27T04:27:36Z")
You can use another JDK where those CVE are fixed until a new release with a new bundled jdk is available. Just set the [JAVA\_HOME](https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html#ls-jvm) variable. ---
**Author:** ![Aditya931](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Aditya931](https://discuss.elastic.co/u/Aditya931)\ **Post date:** [August 27, 2021, 7:05am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/3 "2021-08-27T07:05:47Z")
tried, even after installing separate java and setting java\_home, logstash still refers to its own jdk **av@dev-elasticsearch-west:~$ echo $JAVA\_HOME** **/usr/lib/jvm/java-11-openjdk-amd64** av@dev-elasticsearch-west:~$ sudo service logstash restart av@dev-elasticsearch-west:~$ sudo service logstash status logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: enabled) Active: active (running) since Fri 2021-08-27 07:01:36 UTC; 6s ago Main PID: 14805 (java) Tasks: 15 (limit: 4915) Memory: 309.8M CGroup: /system.slice/logstash.service └─14805 /usr/share/logstash/jdk/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true - Aug 27 07:01:36 dev-elasticsearch-west systemd[1]: Started logstash. **Aug 27 07:01:36 dev-elasticsearch-west logstash[14805]: Using bundled JDK: /usr/share/logstash/jdk** Aug 27 07:01:36 dev-elasticsearch-west logstash[14805]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 27, 2021, 1:35pm UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/4 "2021-08-27T13:35:23Z")
You need to set the `jAVA_HOME` variable for the logstash user, which is named `logstash` when installed using a package manager. You can put it in the `/etc/sysconfig/logstash` file: ```auto JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64 ``` Logstash will read environment variables from this file when starting. ---
**Author:** ![Aditya93](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@Aditya93](https://discuss.elastic.co/u/Aditya93)\ **Post date:** [August 30, 2021, 4:59am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/5 "2021-08-30T04:59:26Z")
> [@leandrojmp](#): > > /etc/sysconfig/logstash Thanks Leandro, but I don't see the mentioned logstash file in my system. I had installed logstash using the below commands as specified here [Installing Logstash | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/installing-logstash.html) Am I missing anything? **wget -qO - [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch) | sudo apt-key add –** **sudo apt-get install apt-transport-https** **echo "deb [https://artifacts.elastic.co/packages/7.x/apt](https://artifacts.elastic.co/packages/7.x/apt) stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list** **sudo apt-get update && sudo apt-get install logstash** ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [August 30, 2021, 1:01pm UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/6 "2021-08-30T13:01:10Z")
In Debian based systems the file that you should edit or create if it not exists is named `/etc/default/logstash`. You can also directly edit the systemd service and add the line: ```auto Environment=JAVA_HOME=/path/to/your/java/home ``` ---
**Author:** ![Aditya93](https://avatars.discourse-cdn.com/v4/letter/a/a87d85/32.png) [@Aditya93](https://discuss.elastic.co/u/Aditya93)\ **Post date:** [August 31, 2021, 4:50am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/7 "2021-08-31T04:50:14Z")
Thanks, this worked. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 28, 2021, 4:50am UTC](https://discuss.elastic.co/t/logstash-using-vulnerable-jdk/282623/8 "2021-09-28T04:50:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.