Some of the Elastic Search products listed below have been affected by the Critical Zero day Log4j vulnerability. Elastic Cloud customers need not worry about this vulnerability as Elastic Cloud Team has not identified any exploitable RCE’s against the product till now and the Investigation is still under way to determine whether there is any impact. Deployments hosted on Elastic Cloud have already have a mitigation in place (MsgNoLookups=true) and this will take effect on restart of deployment or any configuration change to the Deployment.
| Elastic Product | Versions | Status | Patched? |
|---|---|---|---|
| APM Java Agent | 1.17.0-1.28.0 | Vulnerable | Mitigation |
| APM Server | All | Not Vulnerable | Not Needed |
| Beats | All | Not Vulnerable | Not Needed |
| Cmd | All | Not Vulnerable | Not Needed |
| Elastic Agent | All | Not Vulnerable | Not Needed |
| Elastic Cloud Enterprise | All | Not Vulnerable | Not Needed |
| Elastic Cloud | All | Not Vulnerable | Not Needed |
| Elastic Cloud on Kubernetes | All | Not Vulnerable | Not Needed |
| Elastic Endgame | All | Not Vulnerable | Not Needed |
| Elastic Maps Service | All | Not Vulnerable | Not Needed |
| Elasticsearch | < 6.8.21, < 7.16.1 | Not Vulnerable | Not Needed |
| Elasticsearch | => 7.16.1 | Vulnerable | Mitigation |
| Endpoint Security | All | Not Vulnerable | Not Needed |
| Enterprise Search | All | Not Vulnerable | Not Needed |
| Fleet Server | All | Not Vulnerable | Not Needed |
| Kibana | All | Not Vulnerable | Not Needed |
| Logstash | < 6.8.21, < 7.16.1 | Vulnerable | Fixed |
| Machine Learning | All | Not Vulnerable | Not Needed |
| Swiftype | All | Not Vulnerable | Not Needed |