Hi all, I just became aware of this security issue that I think applies to OpenSearch since version 1.0.0 [image] Log4Shell: RCE 0-day exploit found in log4j, a popular Java logging package |... Given how ubiquitous log4j is, the impact of this vulnerability is quite severe. Learn how to fix Log4Shell, why it's bad, and what a working exploit requires in this post. it’s basically an REC issue when log4j2 is used and process logs client requests. would like to see what people think and if there is any plan to patch this. Thank you, Long

Hey @longhoang - we’re working on it. [image] Log4j Patch for CVE-2021-44228 Announcements Update 2021-12-22: OpenSearch 1.2.3 is now available - please see Log4j Patch for CVE-2021-45105 Update 2021-12-16: OpenSearch 1.2.2 now available - please see: Log4j Patch for CVE-2021-45046 Update 2021-12-15: OpenSearch 1.2.2 is in progress which addresses CVE-2021-45046. See the updated blog post for more info. Update 2021-12-11: OpenSearch 1.2.1 has been released. A security issue was recently disclosed (CVE-2021-44228) affecting the broadly-used Apache Log4j library. Software in the Ope…

Is it safe to use the log4j2.formatMsgNoLookups=true JVM option with Elasticsearch? I would assume so, but wanted to ask before making any changes.

@dswitzer2 We’re working to figure out if that covers it.

I know you are all busy, but hopefully, your resolution will cover Opendistro also, since I am not yet able to cross-grade to Opensearch. Opendistro v1.13.2 ES-oss v 7.10.2 tx, rlk

@rlk5546 Yeah - we’re looking at an Open Distro fix currently. We wanted to get OpenSearch out of the way first.

Preliminarily, it looks like the log4j2.formatMsgNoLookups mitigation is acceptable, but not ideal. This will be the path for some users that will be difficult to upgrade. Stay tuned.

Look like version 1.2 is patched https://github.com/opensearch-project/OpenSearch/commit/e3a44fa71b290fb265a94ef4297f044b9a63a762. But there is no updated docker image version yet, did I miss it somewhere or it will take some time for the image to be published in dockerhub?

@tomas123 No - it’s not out yet. Having a patch in the code vs the distribution out is quite different. Working on getting it out this morning.

Hey folks - OpenSearch and Open Distro have both been updated.

Do we know if there is likely to be any backports available for the earlier versions of OpenDistro too?

Log4j2 vulnerability in OpenSearch

Security

searchymcsearchface December 10, 2021, 4:51pm 2

Hey @longhoang - we’re working on it.

Topic		Replies	Views
Logstash OSS with OpenSearch Output Plugin Log4j vulnerable OpenDistro cve , security-issue	7	1988	December 16, 2021
OpenSearch 1.2.2 version still showing log4j Vulnerability findings Security cve , security-issue	13	1254	January 10, 2022
Log4j Patch for CVE-2021-44228 Announcements cve	3	13580	December 16, 2021
Does CVE-2021-44228 impact OpenSearch General Feedback cve	9	1792	December 20, 2021
Log4j Patch for CVE-2021-45046 Announcements releases , cve	0	999	December 16, 2021

Log4j2 vulnerability in OpenSearch

Related topics