# Log4j2 vulnerability in OpenSearch

**URL:** <https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935>\
**Category:** Security\
**Tags:** discuss, cve, security-issue\
**Created:** [December 10, 2021, 5:20am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935 "2021-12-10T05:20:39Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [December 10, 2021, 4:51pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/2 "2021-12-10T16:51:26Z")

</div>

Hey @longhoang - we’re working on it.

> [@Log4j Patch for CVE-2021-44228](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950):
>
> Update 2021-12-22: OpenSearch 1.2.3 is now available - please see [Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119) Update 2021-12-16: OpenSearch 1.2.2 now available - please see: [Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058) Update 2021-12-15: OpenSearch 1.2.2 is in progress which addresses CVE-2021-45046. [See the updated blog post for more info](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/#update-dec-14-2021). Update 2021-12-11: [OpenSearch 1.2.1 has been released.](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/) A security issue was [recently disclosed](https://www.lunasec.io/docs/blog/log4j-zero-day/) ([CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)) affecting the broadly-used [Apache Log4j](https://logging.apache.org/log4j/2.x/) library. Software in the Ope…

---

_[View the full topic](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935)._