ansible-role-elasticsearch icon indicating copy to clipboard operation
ansible-role-elasticsearch copied to clipboard

Published 20 hours ago • verified publisher icon geerlingguy

Add fix for log4shell vulnerability

Open rutger1140 opened this issue 3 years ago • 7 comments

Add formatMsgNoLookups boolean to jvm.options configuration to prevent log4j attack vectors. As per this article.

rutger1140 avatar Dec 21 '21 13:12 rutger1140

This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark pull requests as stale.

stale[bot] avatar Jun 18 '22 20:06 stale[bot]

Opened 6 months ago. Approved 3 months ago and still going stale 🤷‍♂️

rutger1140 avatar Jun 18 '22 21:06 rutger1140

This issue is no longer marked for closure.

stale[bot] avatar Jun 18 '22 21:06 stale[bot]

This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark pull requests as stale.

stale[bot] avatar Sep 19 '22 23:09 stale[bot]

Not stale, I mean.. 😺

esolitos avatar Sep 26 '22 08:09 esolitos

This issue is no longer marked for closure.

stale[bot] avatar Sep 26 '22 08:09 stale[bot]

Not stale, I mean.. 😺

Not sure what you mean.

rutger1140 avatar Sep 26 '22 11:09 rutger1140

@geerlingguy I know this project is handled on a best-effort basis, but I think this definitely needs some attention

fourstepper avatar Nov 14 '22 09:11 fourstepper

@geerlingguy I know this project is handled on a best-effort basis, but I think this definitely needs some attention

I couldn’t agree more 👍 This way people end up forking the project to keep it maintained, which is causing fragmentation. I’m happy to help.

rutger1140 avatar Nov 14 '22 12:11 rutger1140

Approved by someone who's not a maintainer ;)

I should note that I don't personally use elasticsearch anymore (moved on to other stacks), so this role is in maintenance mode. I'll merge this since it doesn't seem like it should do any harm.

Editorializing, but: not sure if ES instances would be vulnerable by default regardless... the annoying thing with L4S is you have to evaulate on a per application and sometimes per deployment basis whether you're actually open to the attack. I know a lot of people are forced to add these options so automated vulnerability scanners can be made to be quiet :(

geerlingguy avatar Nov 14 '22 15:11 geerlingguy