Urgent - Incomplete fix for Apache Log4j vulnerability v2.15.0

[ppafford (Phill Pafford)]

Looks like there is another issue and another fix

CVE-2021-45046 - GitHub Advisory Database

And the release of Logstash 7.16.1 Release Notes | Logstash Reference [7.16] | Elastic has the incomplete fix.

When can this be addressed?

[yaauie (Ry Biesemeyer)]

Per the official Security Announcement thread:

@Levine

[Update Dec 14th] Log4j 2.16.0 has been released to address CVE-2021-45046. Logstash is not impacted by the vulnerability disclosed in CVE-2021-45046 because Logstash does not ship with logging layouts that can be exploited to trigger JNDI lookups through Thread Context references. Elastic guidance remains to either remove the JndiLookup.class or upgrade Logstash to 7.16.1 or 6.8.21.

[mp28may (Manish)]

Hi, I am currently using Elasticsearch and Logstash oss version 7.8.0.

The log4j-core and lo4j-api version in Elasticsearch is 2.11.1 and in Logstash it is 2.12.1.

Can i upgrade the log4j jar files (v.2.17.0) in my existing Elasticsearch and Logstash (7.8.0) to solve this vulnerability and without impacting the functioning of ELK.

Or it is necessary to upgrade to ELK v7.16.2 to solve it.