Skip to main content

Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046)

Informer uses Elasticsearch, which was impacted by the Log4j vulnerabilities Elastic announced in mid-December 2021. This is a point-in-time advisory; the steps below apply to the Elasticsearch versions in use at the time.

The vulnerabilities affect Log4j versions 2.0-beta9 through 2.15.0. A remote attacker could exploit them to take control of or inject data into an affected system. Log4j is an open-source, Java-based logging utility used by enterprise applications and cloud services. More details are at CVE-2021-44228 and CVE-2021-45046.

Follow the steps below to mitigate the vulnerability.

Custom plugins

These steps mitigate the vulnerability for the Elasticsearch deployment. Any custom plugins in your environment that were not provided by Entrinsik may still be vulnerable.

Windows​

The Windows installer of the era deployed Oracle Java 8 (build 181), which is vulnerable. To mitigate, replace the Log4j 2.XX JAR files (where XX is 15 or earlier) that ship with Elasticsearch with the current version of Log4j:

  1. Shut down the Informer and Elasticsearch services.
  2. Download the current Log4j binary from logging.apache.org/log4j/2.x/download.html.
  3. Extract the contents of the Log4j archive.
  4. Navigate to the .\lib directory of the Elasticsearch install (by default, C:\Program Files\Elastic\Elasticsearch\lib).
  5. Replace the log4j-api-2.XX and log4j-core-2.XX.0 JAR files in that .\lib directory with the current log4j-api and log4j-core JAR files you downloaded in step 2.

Then start the Elasticsearch and Informer services back up.

Linux (Docker)​

The Linux/Docker install script of the era deployed an Elasticsearch container using OpenJDK build 212, which is vulnerable. To mitigate, edit docker-compose.yml and add this property to the Elasticsearch container's environment block:

- LOG4J_FORMAT_MSG_NO_LOOKUPS=true

For example:

elasticsearch:
  image: elastic/elasticsearch:7.8.0
  environment:
    - TZ=timezonegoeshere
    - ES_JAVA_OPTS=-Xms4g -Xmx4g
    - LOG4J_FORMAT_MSG_NO_LOOKUPS=true
  volumes:
    - ./esdata:/usr/share/elasticsearch/data

Then recreate the Elasticsearch container:

  1. Stop Informer and all associated containers:

    ./stop.sh
    Verify the data volume mount first

    Before continuing, verify that there is a host volume mount for the Elasticsearch data directory (covered in the Elasticsearch Configuration & Migration on Docker/Linux guide in the Configuration section), or you risk data loss.

  2. Delete the Elasticsearch container:

    docker-compose rm elasticsearch

  3. Start Informer and all associated containers:

    ./start.sh