# Log4j2 vulnerability in OpenSearch **URL:** \ **Category:** Security\ **Tags:** discuss, cve, security-issue\ **Created:** [December 10, 2021, 5:20am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935 "2021-12-10T05:20:39Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![usal](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@usal](https://forum.opensearch.org/u/usal)\ **Post date:** [December 16, 2021, 1:34am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/45 "2021-12-16T01:34:03Z")
I am using opensearchproject/logstash-oss-with-opensearch-output-plugin:7.13.4 for logstash container. It cannot find the zip command. Any suggestions? ---
**Author:** ![usal](https://avatars.discourse-cdn.com/v4/letter/u/4491bb/32.png) [@usal](https://forum.opensearch.org/u/usal)\ **Post date:** [December 16, 2021, 1:44am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/46 "2021-12-16T01:44:25Z")
when I tried this, logstash container stopped because, it could not find the output plugin ‘opensearch’. what docker image are you using for logstash? ---
**Author:** ![ritubajaj](https://avatars.discourse-cdn.com/v4/letter/r/9fc29f/32.png) [@ritubajaj](https://forum.opensearch.org/u/ritubajaj)\ **Post date:** [December 16, 2021, 7:11am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/47 "2021-12-16T07:11:37Z")
@usal - Hi, I am running the same setup as @blaklabz. I created a custom images with logstash 7.16.1 as base image and installing opensearch output plugin. Reference Dockerfile: FROM [docker.elastic.co/logstash/logstash:7.16.1](http://docker.elastic.co/logstash/logstash:7.16.1) RUN bin/logstash-plugin install logstash-output-opensearch And post that, I applied same changes as specified by @blaklabz i.e. replacing elasticsearch by opensearch. **Pointer** : output configuration couldn’t contain ‘ilm\_enabled’. ---
**Author:** ![nean](https://avatars.discourse-cdn.com/v4/letter/n/71e660/32.png) [@nean](https://forum.opensearch.org/u/nean)\ **Post date:** [December 16, 2021, 10:36am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/48 "2021-12-16T10:36:24Z")
Has someone checked if the `JndiLookup.class` is used or bundled somewhere else in the framework(s)? ```bash $ grep -ir "JndiLookup.class" /usr/ Binary file /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-tcp-6.0.3-java/vendor/jar-dependencies/org/logstash/inputs/logstash-input-tcp/6.0.3/logstash-input-tcp-6.0.3.jar matches ``` Should this be worrying that the class is in the `logstash-input-tcp` , or has this been detected already? ```auto $ jar -tf logstash-input-tcp-6.0.3.jar | grep -ir JndiLookup Binary file org/apache/logging/log4j/core/lookup/JndiLookup.class matches Binary file org/apache/logging/log4j/core/lookup/Interpolator.class matches Binary file META-INF/org/apache/logging/log4j/core/config/plugins/Log4j2Plugins.dat matches Binary file logstash-input-tcp-6.0.3.jar matches ``` quote [elastic.co](http://elastic.co) on [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 - Security Announcements - Discuss the Elastic Stack](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) > Logstash core will load the Log4j 2.15.0 from core instead of any other log4j-core jar in plugins, so no Jndi Lookups will happen. However, mitigation can be done via: ```bash zip -q -d /usr/share/logstash/vendor/bundle/jruby/*/gems/logstash-input-tcp-*-java/vendor/jar-dependencies/org/logstash/inputs/logstash-input-tcp/*/logstash-input-tcp-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` ---
**Author:** ![sth](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sth](https://forum.opensearch.org/u/sth)\ **Post date:** [December 16, 2021, 12:45pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/49 "2021-12-16T12:45:02Z")
The “Logstash OSS with OpenSearch Output Plugin” on the download page and the corresponding Docker images are months old and are therefore are still using the vulnerable log4j version. Will there be an update? If anything there should be a big warning next to those downloads that they are insecure. If using those packages is not recommended, they should be removed and replaced with instructions for how to use the original Logstash together with OpenSearch. ---
**Author:** ![spapadop](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/spapadop/32/950_2.png) [@spapadop](https://forum.opensearch.org/u/spapadop)\ **Post date:** [December 16, 2021, 12:48pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/50 "2021-12-16T12:48:34Z")
There’s a [thread](https://forum.opensearch.org/t/logstash-oss-with-opensearch-output-plugin-log4j-vulnerable/8021) on this. Bottom-line is that a new release is coming there. ---
**Author:** ![blaklabz](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@blaklabz](https://forum.opensearch.org/u/blaklabz)\ **Post date:** [December 16, 2021, 3:41pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/51 "2021-12-16T15:41:23Z")
So I went to the link ```auto https://hub.docker.com/r/opensearchproject/logstash-oss-with-opensearch-output-plugin ``` This was the link I used for the docker image image: repository: opensearchproject/logstash-oss-with-opensearch-output-plugin tag: latest But as others have mentioned, this image is 1 month old… Waiting on the update. ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 16, 2021, 11:36pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/52 "2021-12-16T23:36:31Z")
Updated [Logstash OSS with OpenSearch Output Plugin](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin) now available as well > [@Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058): > > Update 2021-12-22: OpenSearch 1.2.3 is now available - please see [Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119) 2021-12-20: OpenSearch 1.2.3 is in progress which addresses [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). 2021-12-16: [OpenSearch 1.2.2 is now available](https://opensearch.org/blog/releases/2021/12/update-1-2-2/) As previously tracked in [Log4j Patch for CVE-2021-44228](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950) - [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) was issued shortly following the release of [OpenSearch 1.2.1](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/). This new CVE advises upgrading from Log4j 2.15.0 (used in OpenSearch 1.2.1) to Log4j 2.16.0. Updated [Logstash OSS with OpenSearch Output Plugi…](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin) ---
**Author:** ![tom2](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/tom2/32/2568_2.png) [@tom2](https://forum.opensearch.org/u/tom2)\ **Post date:** [December 18, 2021, 10:40am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/53 "2021-12-18T10:40:46Z")
there is a new log4j 2.17.0 out. Can a new OpenDistro docker image be published? > **[Apache Issues 3rd Patch to Fix New High-Severity Log4j Vulnerability](https://thehackernews.com/2021/12/apache-issues-3rd-patch-to-fix-new-high.html)** > > Apache Issues 3rd Patch to Fix New High-Severity Log4j Vulnerability | Read breaking news and high quality articles on cyber security, hacking, information security, computer security, cybercrime, ethical hacking and technology. ---
**Author:** ![asfoorial](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@asfoorial](https://forum.opensearch.org/u/asfoorial)\ **Post date:** [December 20, 2021, 4:24am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/54 "2021-12-20T04:24:31Z")
Would removing JndiLookup.class be enough to mitigate this vulnerability (CVE-2021-45105) which exists in 2.16? If not, then what is the mitigation process for this vulnerability both on OpenSearch and OpenDistro? ---
**Author:** ![asfoorial](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@asfoorial](https://forum.opensearch.org/u/asfoorial)\ **Post date:** [December 20, 2021, 4:42am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/55 "2021-12-20T04:42:44Z")
Also, if we remove old log4j jar files and replace them with 2.17.0 jars would that be OK and supported both for OpenSearch and OpenDistro? ---
**Author:** ![JulesGraybill](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/julesgraybill/32/1420_2.png) [@JulesGraybill](https://forum.opensearch.org/u/JulesGraybill)\ **Post date:** [December 20, 2021, 5:15pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/56 "2021-12-20T17:15:14Z")
In my _personal_ testing that works just fine, in the sense that I’ve done this with a development cluster that I individually use, the cluster starts up and behaves as expected. The Log4J2 team is very attentive to backward compatibility. However, this isn’t a configuration that the full suite of tests has been run against, which is what I would need to endorse it as a solution. The OpenSearch project team will publish tested versions of OpenSearch that include Log4J2 2.17.0 shortly, and a new docker image that includes Logstash 7.16.2 (which itself contains Log4J2 2.17.0). If you’re using Open Distro, I’d strongly recommend this as the right time to [upgrade to OpenSearch](https://opensearch.org/blog/technical-posts/2021/07/how-to-upgrade-from-opendistro-to-opensearch/). A lot of work has gone into making the upgrade process smooth. ---
**Author:** ![silver\_searcher](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@silver\_searcher](https://forum.opensearch.org/u/silver_searcher)\ **Post date:** [December 22, 2021, 12:27pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/57 "2021-12-22T12:27:45Z")
> [@asfoorial](#): > > Would removing JndiLookup.class be enough to mitigate this vulnerability (CVE-2021-45105) which exists in 2.16? May I bump this question up? For those who can’t upgrade immediately, is there any other action we need to mitigate CVE-2021-45105? I didn’t see any calls like ${ctx:\} in the OpenSearch code base but maybe I’m looking at this too simply. ---
**Author:** ![JulesGraybill](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/julesgraybill/32/1420_2.png) [@JulesGraybill](https://forum.opensearch.org/u/JulesGraybill)\ **Post date:** [December 22, 2021, 6:57pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/58 "2021-12-22T18:57:39Z")
The only mitigation to CVE-2021-45105 [described by the Log4j maintainers](https://logging.apache.org/log4j/2.x/) is to update to Log4j 2.17.0. [OpenSearch version 1.2.3](https://opensearch.org/versions/opensearch-1-2-3.html) was released this morning and updates the Log4j version, so I’d suggest upgrading to that. ---
**Author:** ![silver\_searcher](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@silver\_searcher](https://forum.opensearch.org/u/silver_searcher)\ **Post date:** [December 22, 2021, 11:39pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/59 "2021-12-22T23:39:22Z")
Hi JulesGraybill, I was looking at the [mitigation described here by Apache regarding CVE-2021-45105](https://logging.apache.org/log4j/2.x/security.html): > Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later). > > Alternatively, this infinite recursion issue can be mitigated in configuration: > > ``` > In PatternLayout in the logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC). > Otherwise, in the configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input. > > ``` However, I didn’t find any explicit Pattern Layouts with that format in the code base. Are those 2 items above applicable to the OpenSearch code base as it is right now? ---
**Author:** ![JulesGraybill](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/julesgraybill/32/1420_2.png) [@JulesGraybill](https://forum.opensearch.org/u/JulesGraybill)\ **Post date:** [December 23, 2021, 12:25am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/60 "2021-12-23T00:25:46Z")
Hi @silver_searcher, you’re right that OpenSearch’s codebase doesn’t use pattern layouts in the format that could cause the DOS described in the CVE. So in OpenSearch’s out-of-the-box configuration, we haven’t reproduced the DOS. Informally, I see no reason you wouldn’t be able to mitigate this CVE by avoiding adding a known-bad configuration to a cluster running OpenSearch \< 1.2.3. The remediation we’re recommending as a project is for users to upgrade, because that provides the most comprehensive and provable protection in all configurations, and we’ve heard from many users it’s a priority for them to be running no software that contains Log4j2 \< 2.17.0. ---
**Author:** ![nileshgajwani](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@nileshgajwani](https://forum.opensearch.org/u/nileshgajwani)\ **Post date:** [December 27, 2021, 10:42am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/61 "2021-12-27T10:42:57Z")
Hi @searchymcsearchface and @JulesGraybill We use 3 standalone OpenDistro plugins (security, alerting, job scheduling). Do we need to update the OpenDistro security plugin as we can see the log4j-slf4j-impl-2.11.1.jar there? I could not find a github release for 1.13.3 for the security plugin, can you help me out with the update process?(if an update is required) Thanks in advance ---
**Author:** ![davelago](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/davelago/32/2209_2.png) [@davelago](https://forum.opensearch.org/u/davelago)\ **Post date:** [December 27, 2021, 7:01pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/62 "2021-12-27T19:01:38Z")
Hi @nileshgajwani, The way that [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) was addressed in 1.13.3 was by removing the `JndiLookup` class from the Log4j classpath (see [https://opendistro.github.io/for-elasticsearch/blog/2021/12/update-to-1-13-3/](https://opendistro.github.io/for-elasticsearch/blog/2021/12/update-to-1-13-3/)). There was no newer version released for the security plugin, so 1.13.1 is still the latest one. There is no update indicated specifically for log4j-slf4j-impl-2.11.1.jar, so version 1.13.1 of the security plugin (and others that also didn’t get new releases to address this CVE) are the correct versions provided you are running them with the 1.13.3 version of OpenDistro. Hope that helps clarify things! ---
**Author:** ![asfoorial](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@asfoorial](https://forum.opensearch.org/u/asfoorial)\ **Post date:** [December 29, 2021, 6:01am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/63 "2021-12-29T06:01:46Z")
Yet Another Log4j Vulnerability! [https://nvd.nist.gov/vuln/detail/CVE-2021-44832](https://nvd.nist.gov/vuln/detail/CVE-2021-44832) ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 29, 2021, 4:52pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/64 "2021-12-29T16:52:05Z")
Hello @asfoorial - Yes, we are evaluating necessary actions for this one. [Previous page](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935.md?page=2) [Next page](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935.md?page=4)