Updation of Log4J jar file in Elasticsearch

[osadmin]

Has the following update been made available, if no when to expect?

Please note that the Dynatrace Managed versions listed below still include the vulnerable Log4j library file (/opt/dynatrace-managed/elasticsearch/lib/log4j-core-2.11.1.jar) due to the usage of Elasticsearch. Dynatrace has applied the recommended mitigation measures of removing the org/apache/logging/log4j/core/lookup/JndiLookup.class from the Log4j library. This fully mitigates CVE-2021-44228 and CVE-2021-45046.

An upgrade of Elasticsearch which uses an updated Log4j library is planned.

[andre_vdveen · Accepted solution]

Hi @osadmin yes that update is available.

Updated** versions that mitigate CVE-2021-44228, CVE-2021-45046

• All versions >= 1.230.138
• 1.230.138.20211216-204858
• 1.228.134.20211216-191401
• 1.226.130.20211216-191357
• 1.224.101.20211216-191354

Please take a look at the official security alert article related to the log4j vulnerabilities, here:

https://www.dynatrace.com/news/security-alert/log4shell-log4j-vulnerability/

I believe it will answer all your questions, as it lists all the detected vulnerabilities and Dynatrace's response to each, including the updated versions of all affected components.