Safe options for log4j2 - CVE-2021-44228

elastic / ansible-elasticsearch

Ansible playbook for Elasticsearch

Other

1.59k stars 857 forks source link

Safe options for log4j2 - CVE-2021-44228 #841

Open kcris opened 2 years ago

kcris commented 2 years ago

Given the recent log4j2 security issue it's a good idea to use -Dlog4j2.formatMsgNoLookups=true in the ES role's jvm.options

hendry-lim commented 2 years ago

It was added as the default JVM option in Elasticsearch 7.16.1 81622.

kcris commented 2 years ago

indeed, but what about older ES versions?

hendry-lim commented 2 years ago

The default version for the role has been upgraded to 7.16.2. Even with that flag added, it will still be vulnerable to CVE-2021-45046 without removing the JNDI class, hence the recommendation is to upgrade to 7.16.2.

botelastic[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.