Does CVE-2021-44228 impact OpenSearch

[robcowart]

CVE-2021-44228 has been recently published for log4j. As OpenSearch uses log4j, it would be good to understand the impact and what the plan may be to address any issues.

[ralph]

this has already been brought up here:

Log4j2 vulnerability in OpenSearch

Hi all, I just became aware of this security issue that I think applies to OpenSearch since version 1.0.0 it’s basically an REC issue when log4j2 is used and process logs client requests. would like to see what people think and if there is any plan to patch this. Thank you, Long

i’d suggest to keep the discussions in one place

[searchymcsearchface]

@robcowart you’ve probably seen the banner topic, but yep, we’re working on it. I agree with @ralph - let’s take it over to the other thread.

Log4j Patch for CVE-2021-44228

Update 2021-12-22: OpenSearch 1.2.3 is now available - please see Log4j Patch for CVE-2021-45105 Update 2021-12-16: OpenSearch 1.2.2 now available - please see: Log4j Patch for CVE-2021-45046 Update 2021-12-15: OpenSearch 1.2.2 is in progress which addresses CVE-2021-45046. See the updated blog post for more info. Update 2021-12-11: OpenSearch 1.2.1 has been released. A security issue was recently disclosed (CVE-2021-44228) affecting the broadly-used Apache Log4j library. Software in the Ope…

[robcowart]

Actually I have “banner blindness”, like “ad blindness”. I did a search for CVE-2021-44228 before posting and got no result. Agreed keep it in a single thread.

[searchymcsearchface]

We’re updated in both Open Distro and OpenSearch!

[victor]

I cannot find any information if Logstash OSS with OpenSearch output is affected? And if so, how are we mitigating this? Thanks for the quick and great work.

[thsul]

@searchymcsearchface Is logstoash-oss affected or not? In the elastic article (Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 - Security Announcements - Discuss the Elastic Stack) there is a fix but the current opensearch oss logstash version is from 1 month. If logstash oss is affected, is there any bugfix in progress?

Thanks in advance

[searchymcsearchface]

@victor / @thsul Logstash-oss is affected. OpenSearch doesn’t build Logstash (we only match the OSS version up with the the OpenSearch output plugin), so we’re reliant on Elastic’s release. The mitigations mentioned by Elastic in the forum post would apply.

That being said, it looks like Elastic has 1.16.1 out as of this morning. We have some engineers currently working on updating the distribution and confirming that the fix is in place.

[thsul]

Thanks for the reply. Elastic released another patch.

[kris]

We’re working on a 1.2.3 release - and will also work to update our Logstash Docker image