# Logstash OSS with OpenSearch Output Plugin Log4j vulnerable **URL:** \ **Category:** OpenDistro\ **Tags:** cve, security-issue\ **Created:** [December 15, 2021, 3:09pm UTC](https://forum.opensearch.org/t/logstash-oss-with-opensearch-output-plugin-log4j-vulnerable/8021 "2021-12-15T15:09:42Z")\ **Posts on this page:** 1\ **Showing post:** 9
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 16, 2021, 11:37pm UTC](https://forum.opensearch.org/t/logstash-oss-with-opensearch-output-plugin-log4j-vulnerable/8021/9 "2021-12-16T23:37:08Z")
Updated [Logstash OSS with OpenSearch Output Plugin](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin) now available as well > [@Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058): > > Update 2021-12-22: OpenSearch 1.2.3 is now available - please see [Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119) 2021-12-20: OpenSearch 1.2.3 is in progress which addresses [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). 2021-12-16: [OpenSearch 1.2.2 is now available](https://opensearch.org/blog/releases/2021/12/update-1-2-2/) As previously tracked in [Log4j Patch for CVE-2021-44228](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950) - [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) was issued shortly following the release of [OpenSearch 1.2.1](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/). This new CVE advises upgrading from Log4j 2.15.0 (used in OpenSearch 1.2.1) to Log4j 2.16.0. Updated [Logstash OSS with OpenSearch Output Plugi…](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin) --- _[View the full topic](https://forum.opensearch.org/t/logstash-oss-with-opensearch-output-plugin-log4j-vulnerable/8021)._