Hi all, I just became aware of this security issue that I think applies to OpenSearch since version 1.0.0 [image] Log4Shell: RCE 0-day exploit found in log4j, a popular Java logging package |... Given how ubiquitous log4j is, the impact of this vulnerability is quite severe. Learn how t…

Hey @longhoang - we’re working on it. [image] Log4j Patch for CVE-2021-44228 Announcements Update 2021-12-22: OpenSearch 1.2.3 is now available - please see Log4j Patch for CVE-2021-45105 Update 2021-12-16: OpenSearch 1.2.2 now available - please see: Log4j Patch for CVE…

Is it safe to use the log4j2.formatMsgNoLookups=true JVM option with Elasticsearch? I would assume so, but wanted to ask before making any changes.

@dswitzer2 We’re working to figure out if that covers it.

I know you are all busy, but hopefully, your resolution will cover Opendistro also, since I am not yet able to cross-grade to Opensearch. Opendistro v1.13.2 ES-oss v 7.10.2 tx, rlk

@rlk5546 Yeah - we’re looking at an Open Distro fix currently. We wanted to get OpenSearch out of the way first.

Preliminarily, it looks like the log4j2.formatMsgNoLookups mitigation is acceptable, but not ideal. This will be the path for some users that will be difficult to upgrade. Stay tuned.

Look like version 1.2 is patched https://github.com/opensearch-project/OpenSearch/commit/e3a44fa71b290fb265a94ef4297f044b9a63a762 . But there is no updated docker image version yet, did I miss it somewhere or it will take some time for the image to be published in dockerhub?

@tomas123 No - it’s not out yet. Having a patch in the code vs the distribution out is quite different. Working on getting it out this morning.

Hey folks - OpenSearch and Open Distro have both been updated.

Do we know if there is likely to be any backports available for the earlier versions of OpenDistro too?

Log4j2 vulnerability in OpenSearch

Security

searchymcsearchface December 10, 2021, 4:51pm 2

Hey @longhoang - we’re working on it.

Topic		Replies	Views
Logstash OSS with OpenSearch Output Plugin Log4j vulnerable OpenDistro cve , security-issue	7	1926	December 16, 2021
OpenSearch 1.2.2 version still showing log4j Vulnerability findings Security cve , security-issue	13	1187	January 10, 2022
Log4j Patch for CVE-2021-44228 Announcements cve	3	13533	December 16, 2021
Does CVE-2021-44228 impact OpenSearch General Feedback cve	9	1731	December 20, 2021
Log4j Patch for CVE-2021-45046 Announcements releases , cve	0	976	December 16, 2021

Log4j2 vulnerability in OpenSearch

Related topics