log4j outdated

[jatty]

docker containers logstash and elasticsearch use log4j-core-2.14.0.jar and log4j-core-2.11.1.jar
These should be updated to log4j version 2.15 because of CVE-2021-44228

[antoineco]

@jatty all base images used in this stack are built and released by Elastic, not by us.

Sources: https://github.com/elastic/elasticsearch/tree/master/distribution/docker

I believe Elastic may re-build recent images, in which case you will get the update automatically after clearing your Docker image cache.

[antoineco]

Related: elastic/elasticsearch#81629

According to the comment, the vulnerability was addressed by disabling the problematic class.
An upgrade of the library will follow, but like I mentioned this is in the hands of Elastic and not docker-elk.

Closing as mitigated + out of our control.

[antoineco]

Quick update, I posted a more detailed answer in #645.

tl;dr I'm expecting a new patch release of Elastic components to land this week.