Log4j2 vulnerability in OpenSearch

Security
, ,
65

Hello All

Happy New Year to everyone!

In order to fix the log4j vulnerability, I tried to install the latest logstah oss version 7.16.2 and we are using OpenDistro ElasticSearch of version 1.13.3 ( recently upgraded from 1.13.2 to 1.13.3 due to log4j issue).

I could notice 'Compatibility errors" after installing and starting the logstash service.
Please let us know if the logstash-oss 7.16.2 is not compatible with OpenDistro ElasticSearch 1.13.3.
If yes, could you please confirm if this will be fixed in the future logstash-oss versions?

Error logs:

Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2022-01-03T13:39:33,407][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2022-01-03T13:39:33,421][INFO ][logstash.runner ] Starting Logstash {“logstash.version”=>“7.16.2”, “jruby.version”=>“jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 25.302-b08 on 1.8.0_302-b08 +indy +jit [linux-x86_64]”}
[2022-01-03T13:39:34,743][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2022-01-03T13:39:36,327][INFO ][org.reflections.Reflections] Reflections took 70 ms to scan 1 urls, producing 119 keys and 417 values
[2022-01-03T13:39:37,703][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>“LogStash::Outputs::ElasticSearch”, :hosts=>[“https://msb-elk.de050.corpintra.net:9200”]}
[2022-01-03T13:39:37,742][WARN ][logstash.outputs.elasticsearch][main] ** WARNING ** Detected UNSAFE options in elasticsearch output configuration!
** WARNING ** You have enabled encryption but DISABLED certificate verification.
** WARNING ** To make sure your data is secure change :ssl_certificate_verification to true
[2022-01-03T13:39:38,072][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>, :added=>[https://elastic:xxxxxx@msb-elk.de050.corpintra.net:9200/]}}
[2022-01-03T13:39:38,479][ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>“main”, :exception=>#<LogStash::ConfigurationError: Could not connect to a compatible version of Elasticsearch>, :backtrace=>[“/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.2.3-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:247:in `block in healthcheck!'”

Thanks in advance!

67

maybe migrate to opensearch or amazon_es output plugins for logstash.

1 Like
68

Hi @kris , is there plan to release OpenSearch 1.2.4 with log4j 2.17.1?

69

@longhoang Yes, it will have Log4j 2.17.1. See below link.

  1. Bump log4j to 2.17.1 · Issue #1548 · opensearch-project/security · GitHub
70

thanks @John - correct @longhoang, that is what we’re evaluating currently

71

awesome, thanks guys
any chance you are aware of ETA of 1.2.4?

72

@longhoang no ETA yet

1 Like
73

Update: we’re going to aim for Jan 18 to release 1.2.4. Feel free to follow progress on the Github issue.

5 Likes
74

Hi All, Need help/suggestion on remediating log4j vulnerability in my OD setup.
I am running 0.10.0 (ES version 6.8.1). I am running RHEL7 with JDK 11.
By going through all messages here and on ES website, it seems We are not affected by 2 of CVE but we will have remediate other 2.
But our security is asking u sin any case upgrade log4j from 2.11.
Now I have 2 questions:
Do we have any tested doc for upgrading log4j only in OD 0.10.0 setup
Can I upgrade from OD 0.10.0(6.8.1) to ES 6.8.23 version which has mitigated all vulnerabilities.

We can upgrade/migrate to ES 7.x.

Any suggestion will be appreciated.
Thanks.

75

Hello @ravibhooshan , regarding you question about upgrading Log4j without upgrading anything else, I would imagine that would be unsupported. The differences in the way Log4j handles things between versions may cause issues if not upgrading everything together. Also, for the time being, there is an upgrade path between OpenDistro for Elasticsearch and OpenSearch however, this may not be the case in the future depending on the differences. I would suggest migrating to OpenSearch as a way to stay current on features, performance optimizations and security. Below is one document on how to perform the upgrade process that may help you.

  1. Upgrade from Elasticsearch OSS to OpenSearch - OpenSearch documentation
1 Like
76

Hi,
We uses logstash on Windows machines, but on download page there is no such version for new logstash with OpenSearch output plugin!!! What we can do to protect our customers from log4j vulnerability?
Thanks

77

You’ll need to get Logstash and the output plugin separately.

  1. Download Logstash OSS
  2. Download Logstash Output Plugin for OpenSearch or as a Ruby Gem
1 Like
80

(post deleted by author)