# Log4j2 vulnerability in OpenSearch

**URL:** <https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935>\
**Category:** Security\
**Tags:** discuss, cve, security-issue\
**Created:** [December 10, 2021, 5:20am UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935 "2021-12-10T05:20:39Z")\
**Posts on this page:** 1\
**Showing post:** 52

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [December 16, 2021, 11:36pm UTC](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/52 "2021-12-16T23:36:31Z")

</div>

Updated [Logstash OSS with OpenSearch Output Plugin](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin) now available as well

> [@Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058):
>
> Update 2021-12-22: OpenSearch 1.2.3 is now available - please see [Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119) 2021-12-20: OpenSearch 1.2.3 is in progress which addresses [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). 2021-12-16: [OpenSearch 1.2.2 is now available](https://opensearch.org/blog/releases/2021/12/update-1-2-2/) As previously tracked in [Log4j Patch for CVE-2021-44228](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950) - [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) was issued shortly following the release of [OpenSearch 1.2.1](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/). This new CVE advises upgrading from Log4j 2.15.0 (used in OpenSearch 1.2.1) to Log4j 2.16.0. Updated [Logstash OSS with OpenSearch Output Plugi…](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin)

---

_[View the full topic](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935)._