# Log4j Patch for CVE-2021-44228 **URL:** \ **Category:** Announcements\ **Tags:** cve\ **Created:** [December 10, 2021, 4:49pm UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950 "2021-12-10T16:49:25Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 10, 2021, 4:49pm UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/1 "2021-12-10T16:49:26Z")
**Update 2021-12-22: OpenSearch 1.2.3 is now available - please see [Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119)** Update 2021-12-16: OpenSearch 1.2.2 now available - please see: [Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058) Update 2021-12-15: OpenSearch 1.2.2 is in progress which addresses CVE-2021-45046. [See the updated blog post for more info](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/#update-dec-14-2021). Update 2021-12-11: [OpenSearch 1.2.1 has been released.](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/) A security issue was [recently disclosed](https://www.lunasec.io/docs/blog/log4j-zero-day/) ([CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)) affecting the broadly-used [Apache Log4j](https://logging.apache.org/log4j/2.x/) library. Software in the OpenSearch project includes versions of Log4j which are referenced in this CVE. The team ~~is working to~~ has upgraded the Log4j version in OpenSearch to 2.15.0 as recommended by the advisory. All users should upgrade their OpenSearch clusters to this new version. ~~Further updates will come on this thread - please stay tuned for further details.~~ ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 10, 2021, 4:49pm UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/2 "2021-12-10T16:49:58Z")
Made this a banner on December 10, 2021, 4:49pm UTC. It will appear at the top of every page until it is dismissed by the user. ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [December 11, 2021, 4:21am UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/3 "2021-12-11T04:21:12Z")
Update: The mitigations are in place for OpenSearch 1.2.0 + Open Distro 1.13.2. A build has been created and the team has kicked off our final round of performance testing. This testing takes approximately 7-8 hours to run. The team will let this run over night and is reconvening in the morning (2021/12/11) to review the data and, assuming no issues, kick off the distribution. ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 11, 2021, 8:47pm UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/4 "2021-12-11T20:47:33Z")
OpenSearch 1.2.1 is out now! - information available here: > [@searchymcsearchface](#): > > Update 2021-12-11: [OpenSearch 1.2.1 has been released.](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/) ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 16, 2021, 7:39pm UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/5 "2021-12-16T19:39:40Z")
Removed this banner on December 16, 2021, 7:39pm UTC. It will no longer appear at the top of every page. ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 16, 2021, 7:45pm UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/6 "2021-12-16T19:45:14Z")
OpenSearch 1.2.2 now available - please see: [Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058) ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [February 15, 2023, 1:19am UTC](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950/7 "2023-02-15T01:19:35Z")
Closed on February 15, 2023, 1:19am UTC