# OpenSearch 1.2.2 version still showing log4j Vulnerability findings **URL:** \ **Category:** Security\ **Tags:** cve, security-issue\ **Created:** [December 21, 2021, 5:48am UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098 "2021-12-21T05:48:29Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Naga10](https://avatars.discourse-cdn.com/v4/letter/n/ecae2f/32.png) [@Naga10](https://forum.opensearch.org/u/Naga10)\ **Post date:** [December 21, 2021, 5:48am UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/1 "2021-12-21T05:48:29Z")
Hi Team, We have installed OpenSearch 1.2.2 Version recently and its still showing the log4j vulnerability scan. For the remediation, May I know the next version would be helpful and when it can be live to use? Please advice! ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 21, 2021, 4:26pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/2 "2021-12-21T16:26:45Z")
Hello @Naga10 - we are working to release 1.2.3 to address CVE-2021-45105. We should know a target release date soon. We will keep this post updated: > [@Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058): > > Update 2021-12-22: OpenSearch 1.2.3 is now available - please see [Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119) 2021-12-20: OpenSearch 1.2.3 is in progress which addresses [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). 2021-12-16: [OpenSearch 1.2.2 is now available](https://opensearch.org/blog/releases/2021/12/update-1-2-2/) As previously tracked in [Log4j Patch for CVE-2021-44228](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950) - [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) was issued shortly following the release of [OpenSearch 1.2.1](https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/). This new CVE advises upgrading from Log4j 2.15.0 (used in OpenSearch 1.2.1) to Log4j 2.16.0. Updated [Logstash OSS with OpenSearch Output Plugi…](https://opensearch.org/downloads.html#logstash-oss-with-opensearch-output-plugin) ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [December 21, 2021, 7:00pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/3 "2021-12-21T19:00:28Z")
@kris are there also plans to update the Log4j implementation in the Logstash-OSS with Opensearch Plugin as well? Thanks. ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 21, 2021, 7:59pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/4 "2021-12-21T19:59:28Z")
Hello @John - even better news - Just confirmed with the team: We have already released logstash output plugin - [Docker Hub](https://hub.docker.com/r/opensearchproject/logstash-oss-with-opensearch-output-plugin/tags) ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [December 21, 2021, 8:03pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/5 "2021-12-21T20:03:09Z")
We have the Tarball install and not Docker. The plan is to migrate to docker but right now it is untested in our environment and we are just trying to keep up with the CVEs being published. ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 21, 2021, 9:20pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/6 "2021-12-21T21:20:13Z")
Working to get these out soon. ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [December 21, 2021, 9:24pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/7 "2021-12-21T21:24:36Z")
Very much appreciated. ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [December 22, 2021, 1:00am UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/8 "2021-12-22T01:00:14Z")
@kris Just saw the 7.16.2 tarball dropped. Thanks. Yall are awesome! ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [December 22, 2021, 8:44pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/9 "2021-12-22T20:44:56Z")
OpenSearch 1.2.3 is now available: > [@Log4j Patch for CVE-2021-45105](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45105/8119): > > 2021-12-22: [OpenSearch 1.2.3 is now available](https://opensearch.org/blog/releases/2021/12/update-1-2-3/) As previously tracked in [Log4j Patch for CVE-2021-45046](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-45046/8058) & [Log4j Patch for CVE-2021-44228](https://forum.opensearch.org/t/log4j-patch-for-cve-2021-44228/7950) - [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105) was issued shortly following the release of OpenSearch 1.2.2. This new CVE advises upgrading from Log4j 2.16.0 (used in OpenSearch 1.2.2) to Log4j 2.17.0. All users should upgrade their OpenSearch clusters to this new version [OpenSearch 1.2.3](https://opensearch.org/blog/releases/2021/12/update-1-2-3/) ---
**Author:** ![Naga10](https://avatars.discourse-cdn.com/v4/letter/n/ecae2f/32.png) [@Naga10](https://forum.opensearch.org/u/Naga10)\ **Post date:** [January 2, 2022, 7:42am UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/10 "2022-01-02T07:42:43Z")
> [@kris](#): > > OpenSearch 1.2.3 is now available @kris Is Log4j issue has been remediated to OpenSearch 1.2.3 package? Is there any other packages are going o release? So that we can wait and use the latest one. pls advice ---
**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\ **Post date:** [January 3, 2022, 11:24pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/11 "2022-01-03T23:24:54Z")
Hello @Naga10 - yes, here is the timeline of OpenSearch releases so far: CVE-2021-44228 - update to Log4j 2.15.0 - OpenSearch 1.2.1 was released 12/11/2021 CVE-2021-45046 - update to Log4j 2.16.0 - OpenSearch 1.2.2 was released 12/16/2021 CVE-2021-45105 - update to Log4j 2.17.0 - OpenSearch 1.2.3 was released 12/22/2021 There is CVE-2021-44832 that has been identified with the recommendation to update to Log4j 2.17.1 - the team is currently evaluating this. ---
**Author:** ![Naga10](https://avatars.discourse-cdn.com/v4/letter/n/ecae2f/32.png) [@Naga10](https://forum.opensearch.org/u/Naga10)\ **Post date:** [January 4, 2022, 9:44am UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/12 "2022-01-04T09:44:53Z")
Hi @kris Recently we have upgraded to opensearch-1.2.3 version. So it means, we need one more upgrade to Log4j 2.17.1 version once after the new release. is it? ---
**Author:** ![John](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@John](https://forum.opensearch.org/u/John)\ **Post date:** [January 4, 2022, 2:07pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/13 "2022-01-04T14:07:52Z")
@Naga10 Yes, there should be another update coming down the pipe. ---
**Author:** ![Opensource.exp](https://avatars.discourse-cdn.com/v4/letter/o/838e76/32.png) [@Opensource.exp](https://forum.opensearch.org/u/Opensource.exp)\ **Post date:** [January 10, 2022, 7:44pm UTC](https://forum.opensearch.org/t/opensearch-1-2-2-version-still-showing-log4j-vulnerability-findings/8098/14 "2022-01-10T19:44:13Z")
There is a meeting tomorrow on this that will discuss log4j vulnerability, you can register for it here: [Workshop: Migrate from Elasticsearch to OpenSearch](https://info.instaclustr.com/workshop-migrate-elasticsearch-to-opensearch.html?utm_source=mkto&utm_medium=email&utm_campaign=fletcher)