atlassion/rs4logj-cve-2021-44228Provides upgrade and mitigation instructions for Apache Log4j vulnerability CVE-2021-44228 in Remote Syslog products, including version checks and configuration changes for Elasticsearch.
Remote Syslog uses the Elasticsearch module to save logging.
Effected products:
RSC is not effected.
Check version:
curl -XGET 'http://localhost:9200'
Output:
"number" : "7.16.2"
or
"number" : "6.8.22"
Official document Elasticsearch:
https://www.elastic.co/blog/new-elasticsearch-and-logstash-releases-upgrade-apache-log4j2
All versions below: 7.16.2 or 6.8.22 are vulnerable. If the version is higher you are good to go and no action is needed.
sudo apt update && sudo apt upgrade
!!Please check if the recommended version or higher is going to be installed!!
Edit:
nano /etc/elasticsearch/jvm.options
Add:
-Dlog4j2.formatMsgNoLookups=true
Restart elasticsearch service:
service elasticsearch restart