# Remedy for CVE-2018-8088 in elastic-apm-agent-1.21.0.jar?
**URL:** https://discuss.elastic.co/t/remedy-for-cve-2018-8088-in-elastic-apm-agent-1-21-0-jar/264775
**Category:** APM
**Tags:** java
**Created:** [February 19, 2021, 12:51am UTC](https://discuss.elastic.co/t/remedy-for-cve-2018-8088-in-elastic-apm-agent-1-21-0-jar/264775 "2021-02-19T00:51:29Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@seanleblanc](https://discuss.elastic.co/u/seanleblanc)
#### Post date: [February 19, 2021, 12:51am UTC](https://discuss.elastic.co/t/remedy-for-cve-2018-8088-in-elastic-apm-agent-1-21-0-jar/264775/1 "2021-02-19T00:51:29Z")
A scan is turning up a CVE for this:
```auto
CRITICAL Vulnerability found in non-os package type (java) - /elastic-apm-agent-1.21.0.jar:slf4j-api (CVE-2018-8088 - https://nvd.nist.gov/vuln/detail/CVE-2018-8088)
```
This showed up in an earlier version, too (1.17.0). 1.21.0 is the latest and still has this?
---
### Author:  [@felixbarny](https://discuss.elastic.co/u/felixbarny)
#### Post date: [February 19, 2021, 7:46am UTC](https://discuss.elastic.co/t/remedy-for-cve-2018-8088-in-elastic-apm-agent-1-21-0-jar/264775/2 "2021-02-19T07:46:39Z")
Hi and thanks a lot for the report.
For security reports, please don't report them in the forum but stick to the process laid out in [Free and Open Search: The Creators of Elasticsearch, ELK & Kibana | Elastic](https://www.elastic.co/community/security).
For this particular case it seems like a false positive.
The CVE is about the slf4j-ext module which the agent does not use. We only use slf4j-api which does not contain the vulnerable `org.slf4j.ext.EventData` class.
Nevertheless, I'll update the slf4j version and make sure we'll stay up to date with new versions: [Update slf4j and add to dependabot allow list by felixbarny · Pull Request #1669 · elastic/apm-agent-java · GitHub](https://github.com/elastic/apm-agent-java/pull/1669)
---
### Author:  [@seanleblanc](https://discuss.elastic.co/u/seanleblanc)
#### Post date: [February 19, 2021, 9:02pm UTC](https://discuss.elastic.co/t/remedy-for-cve-2018-8088-in-elastic-apm-agent-1-21-0-jar/264775/3 "2021-02-19T21:02:00Z")
Oh, thank you. I did not realize there was a separate process for this. In any case, this was Anchore finding this, if that helps at all. Forgot to mention that in original question.
Cheers.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2021, 5:02pm UTC](https://discuss.elastic.co/t/remedy-for-cve-2018-8088-in-elastic-apm-agent-1-21-0-jar/264775/4 "2021-03-12T17:02:36Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.