# Log4j issue - CVE-2021-44832 **URL:** \ **Category:** Security\ **Tags:** discuss, cve, security-issue\ **Created:** [January 6, 2022, 11:06am UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217 "2022-01-06T11:06:07Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![yashrajsamaiya](https://avatars.discourse-cdn.com/v4/letter/y/ccd318/32.png) [@yashrajsamaiya](https://forum.opensearch.org/u/yashrajsamaiya)\ **Post date:** [January 6, 2022, 11:06am UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/1 "2022-01-06T11:06:07Z")
[CVE-2021-44832] - This bug was reported in 28th dec 2021. Please confirm whether this is fixed in OpenSearch v1.2.3 [https://logging.apache.org/log4j/2.x/security.html#](https://logging.apache.org/log4j/2.x/security.html#) ---
**Author:** ![ralph](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/ralph/32/1194_2.png) [@ralph](https://forum.opensearch.org/u/ralph)\ **Post date:** [January 6, 2022, 12:48pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/2 "2022-01-06T12:48:00Z")
most likely not as it is being tracked with this ticket for 1.2.4: [https://github.com/opensearch-project/opensearch-build/issues/1417](https://github.com/opensearch-project/opensearch-build/issues/1417) ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [January 6, 2022, 2:10pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/3 "2022-01-06T14:10:29Z")
Not in 1.2.3. It will be fixed in the next release. From what I understand, this one is pretty narrow in how it applies to OpenSearch so the urgency is lower. Indeed, it’s a “Moderate” severity and in context of OpenSearch, random folks don’t have permission to modify the logging configuration file. Likely, if a user has access to modify the logging config file, this user probably already able to execute code arbitrarily. ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [January 6, 2022, 2:44pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/4 "2022-01-06T14:44:16Z")
@searchymcsearchface good day to you sir. It is not my intention to start a “flame war” but organization risk isn’t generally determined by the “technical” guys like us. For instance, my organization sees something Log4j related come up in vulnerability scans and then the system owner wants to nuke whatever it is immediately. We currently have our Opensearch Instances and Logstash shutdown until patches are released for CVE-2021-44832 because that is the only “acceptable risk reduction” that would be accepted by our system owner. I’m not saying it is like this across the board with every organization but in our small little bubble of the world, this is the way it works. I mean no ill will and really love the Opensearch project so please don’t take this as a jab but rather a different perspective. Thanks. 🙂 ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [January 6, 2022, 2:52pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/6 "2022-01-06T14:52:58Z")
I can certainly pass that along. Do you typically shutdown based on any moderate CVE or is this just because of Log4j being so pervasive? ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [January 6, 2022, 2:57pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/7 "2022-01-06T14:57:50Z")
Depends. The more “media attention” something gets. Log4j has been really publicized so it is more at the forefront of the mind of our system owner. Then there is organizational policy that states, “if it is not patched by this date, then the system should be taken offline”. No caveats or exceptions so in our case, if it is related to this current string of Log4j vulnerabilities, that is the way it is. Also, CVE ratings don’t account for organizational risk in general, what is moderate to one organization may be critical to another. Basically, it is our organizational policies that are killing us right now and not the vulnerability itself. ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [January 6, 2022, 3:23pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/8 "2022-01-06T15:23:35Z")
I hear you and makes total sense - I’ll bring up that Log4j is especially sensitive beyond the CVE rating or the specific impact to the project. (Personal note: The fact that my 75 year old, non-technical father asked if he should be worried personally about Log4j definitely tells you the media attention that this is getting 😂) ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [January 6, 2022, 3:37pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/9 "2022-01-06T15:37:00Z")
lol Yeah, in the perfect world the system owner and technical personnel would work together and understand the true risk to the organization due to a particular vulnerability but most of the time it ends up being knee-jerk reactions and the “guilty by association” type “understanding” of the problem. Will look forward to the patch release hopefully soon. I’ve been watching the Github repos and watching the progress for Opensearch 1.2.4 and Logstash like a mad man so kudos for the work being done. ---
**Author:** ![yashrajsamaiya](https://avatars.discourse-cdn.com/v4/letter/y/ccd318/32.png) [@yashrajsamaiya](https://forum.opensearch.org/u/yashrajsamaiya)\ **Post date:** [January 7, 2022, 5:44am UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/10 "2022-01-07T05:44:30Z")
Thanks for the reply. ---
**Author:** ![bbarani](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bbarani](https://forum.opensearch.org/u/bbarani)\ **Post date:** [January 19, 2022, 5:55pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/11 "2022-01-19T17:55:40Z")
We have released OpenSearch 1.2.4 version on Jan 18 2022 that fixes multiple CVE’s including CVE-2021-44832. More details can be found on this [GitHub issue](https://github.com/opensearch-project/opensearch-build/issues/1417) ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [January 21, 2022, 2:36pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/12 "2022-01-21T14:36:57Z")
@bbarani Thanks for the update. Does the team have an ETA for the Logstash update to 7.16.3 with the Opensearch plugin that they are willing to put out? Thanks. Note: Logstash 7.16.3 addresses this CVE which is why I ask here. ---
**Author:** ![bbarani](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bbarani](https://forum.opensearch.org/u/bbarani)\ **Post date:** [January 21, 2022, 8:50pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/13 "2022-01-21T20:50:44Z")
@vamshin @Vijay Can you provide more insights on logstash output plugin release? ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [February 3, 2022, 9:37pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/14 "2022-02-03T21:37:37Z")
@bbarani are there any updates on the Logstash with Opensearch output plugin? We are having a difficult time justifying to our leadership on keeping Opensearch around due to this vulnerability still being in place. Thanks. ---
**Author:** ![bbarani](https://avatars.discourse-cdn.com/v4/letter/b/f475e1/32.png) [@bbarani](https://forum.opensearch.org/u/bbarani)\ **Post date:** [February 5, 2022, 12:19am UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/15 "2022-02-05T00:19:32Z")
@John We are planning to publish the new version next week (Currently targeting Feb 07 2022). I will keep this thread updated with the progress. ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [February 5, 2022, 6:02pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/16 "2022-02-05T18:02:23Z")
@bbarani Thank you for the update. I’ll pass it along to my leadership. ---
**Author:** ![Vijay](https://avatars.discourse-cdn.com/v4/letter/v/4bbf92/32.png) [@Vijay](https://forum.opensearch.org/u/Vijay)\ **Post date:** [February 9, 2022, 11:26pm UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/17 "2022-02-09T23:26:19Z")
Hi @John , We published the new version . This is available for download from [Opensearch 2.2.1 · OpenSearch](https://opensearch.org/downloads.html). ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [February 10, 2022, 1:12am UTC](https://forum.opensearch.org/t/log4j-issue-cve-2021-44832/8217/18 "2022-02-10T01:12:48Z")
@Vijay Thank you for the information. Looks like it is going to be a late night for me but it will be worth it.