Zero-day-exploit in log4j2 which is part of elasticsearch

sandeepkanabar (Sandeep Kanabar) December 21, 2021, 6:41am 96

To all those worrying about log4j jars in vendor directory in Logstash et al, elastic has come out with a removal tool and an excellent article on Logstash - Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation

Topic		Replies	Views
CVE-2021-44228 aka log4shell is logstash and/or elasticsearch affected? Logstash	15	13655	January 12, 2022
Mitigation for Log4j2 vulnerability Logstash	5	3014	January 13, 2022
About fix log4j2 vulnerabilities, use the parameter -Dlog4j2.formatMsgNoLookups=true Elasticsearch	2	1583	March 23, 2023
Elasticsearch-sql-cli jar and log4j vulnerabilty Elasticsearch	2	768	March 17, 2022
Apache Log4j2 vulnerability Elasticsearch	4	1155	January 19, 2022