Zero-day-exploit in log4j2 which is part of elasticsearch

[leandrojmp (Leandro Pereira)]

I think this affect almost every version, 7.16.0, which was released this week, uses log4j-core-2.11.1.jar and log4j-api-2.11.1.jar.

One way of mitigation is to use the following line in the jvm.options file.

-Dlog4j2.formatMsgNoLookups=true