# Opendistro debian package with version 1.13.3

**URL:** <https://forum.opensearch.org/t/opendistro-debian-package-with-version-1-13-3/8016>\
**Category:** Build\
**Created:** [December 15, 2021, 11:36am UTC](https://forum.opensearch.org/t/opendistro-debian-package-with-version-1-13-3/8016 "2021-12-15T11:36:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![voyagersm](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/voyagersm/32/2545_2.png) [@voyagersm](https://forum.opensearch.org/u/voyagersm)\
**Post date:** [December 15, 2021, 11:36am UTC](https://forum.opensearch.org/t/opendistro-debian-package-with-version-1-13-3/8016/1 "2021-12-15T11:36:50Z")

</div>

Hi, where can I find Opendistro packages for Ubuntu 20.04 with version 1.13.3 ?

Thank you.

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [December 15, 2021, 2:29pm UTC](https://forum.opensearch.org/t/opendistro-debian-package-with-version-1-13-3/8016/2 "2021-12-15T14:29:10Z")

</div>

You couldn’t find it because there isn’t one! I know it’s important to a lot of folks but Jules does a great job explaining why it wasn’t feasible. We’re

> [@Log4j2 vulnerability in OpenSearch](https://forum.opensearch.org/t/log4j2-vulnerability-in-opensearch/7935/15):
>
> The Open Distro deb and rpm packages are built on top of the upstream Elasticsearch deb and rpm packages, and those upstream packages are what contains the Log4j2 jars. So we’ve been looking really hard at what the options are for distributing a release that contains a fix, and there are fewer options here than there are for the .tgz and Docker builds. Right now it looks like we’d need to develop a deb & rpm packaging process more or less from scratch, and doing that in a way that retains backw…

Long story short - you should mitigate your clusters by removing the classpath as outlined on the Log4j site (or switch to another distribution of Open Distro, or, better yet, OpenSearch)

---

<div class="post-metadata">

**Author:** ![voyagersm](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/voyagersm/32/2545_2.png) [@voyagersm](https://forum.opensearch.org/u/voyagersm)\
**Post date:** [December 15, 2021, 4:22pm UTC](https://forum.opensearch.org/t/opendistro-debian-package-with-version-1-13-3/8016/3 "2021-12-15T16:22:23Z")

</div>

great, thank you.  
Then I will wait for the OpenSearch Debian packages on January 25 2022 🙂

---

<div class="post-metadata">

**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\
**Post date:** [December 16, 2021, 2:48pm UTC](https://forum.opensearch.org/t/opendistro-debian-package-with-version-1-13-3/8016/4 "2021-12-16T14:48:42Z")

</div>

Make sure you mitigate the log4j stuff in the meantime!