# Security vulnerabilities in Elasticsearch docker images - v 8.2.0

**URL:** <https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [May 25, 2022, 5:41am UTC](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559 "2022-05-25T05:41:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![salvoj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/salvoj/32/85302_2.png) [@salvoj](https://discuss.elastic.co/u/salvoj)\
**Post date:** [May 25, 2022, 5:41am UTC](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559/1 "2022-05-25T05:41:40Z")

</div>

Hi,  
My team recently deployed Elasticsearch v 8.2.0 into an HPE Ezmeral Container Platform (kubernetes based) using ECK.  
Everything is working. However, this platform run a Vulnerability scan on new containers and detected many High and Critical vulnerabilities. Many of them related to log4j issue that Elastic already addressed.  
Could these vulnerabilities be false positives? Any other ideas?

Image Tag: [docker.elastic.co/elasticsearch/elasticsearch:8.2.0](http://docker.elastic.co/elasticsearch/elasticsearch:8.2.0)

Sample list of vulnerabilities:

- "CRITICAL Vulnerability found in non-os package type (java) - /usr/share/Elasticsearch/modules/repository-gcs/log4j-1.2-api-2.17.1.jar (CVE-2022-23305 - [NVD - CVE-2022-23305](https://nvd.nist.gov/vuln/detail/CVE-2022-23305))"
- "CRITICAL Vulnerability found in non-os package type (java) - /usr/share/Elasticsearch/modules/repository-gcs/log4j-1.2-api-2.17.1.jar (CVE-2019-17571 - [NVD - CVE-2019-17571](https://nvd.nist.gov/vuln/detail/CVE-2019-17571))"
- "CRITICAL Vulnerability found in non-os package type (java) - /usr/share/Elasticsearch/modules/repository-s3/log4j-1.2-api-2.17.1.jar (CVE-2020-9493 - [NVD - CVE-2020-9493](https://nvd.nist.gov/vuln/detail/CVE-2020-9493))"

Thanks,  
Jorge

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 25, 2022, 11:50pm UTC](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559/2 "2022-05-25T23:50:54Z")

</div>

Please reach out to [security@elastic.co](mailto:security@elastic.co) as per [Security issues | Elastic](https://www.elastic.co/community/security).

---

<div class="post-metadata">

**Author:** ![salvoj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/salvoj/32/85302_2.png) [@salvoj](https://discuss.elastic.co/u/salvoj)\
**Post date:** [May 26, 2022, 5:23am UTC](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559/3 "2022-05-26T05:23:56Z")

</div>

Thanks @warkolm

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2022, 5:24am UTC](https://discuss.elastic.co/t/security-vulnerabilities-in-elasticsearch-docker-images-v-8-2-0/305559/4 "2022-06-23T05:24:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.