# Elstic Search Log4j

**URL:** <https://community.sonarsource.com/t/elstic-search-log4j/68109>\
**Category:** SonarQube Server / Community Build\
**Tags:** sonarqube, scanner\
**Created:** [July 15, 2022, 2:17pm UTC](https://community.sonarsource.com/t/elstic-search-log4j/68109 "2022-07-15T14:17:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sshreeh](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@sshreeh](https://community.sonarsource.com/u/sshreeh)\
**Post date:** [July 15, 2022, 2:17pm UTC](https://community.sonarsource.com/t/elstic-search-log4j/68109/1 "2022-07-15T14:17:15Z")

</div>

Must-share information (formatted with [Markdown](https://commonmark.org/help/)):

- which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension): 8.9.7
- what are you trying to achieve: To get more info on Elsticsearch Log4j
- what have you tried so far to achieve this: Checked community portal but it did not clearified.

Hello team,  
Is there any way to know how there is no vulnerability when elasticsearch contains Log4j file?  
Could you please share more details on the same?

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [July 15, 2022, 5:28pm UTC](https://community.sonarsource.com/t/elstic-search-log4j/68109/2 "2022-07-15T17:28:26Z")

</div>

Hi,

Welcome to the community!

I guess you didn’t get around to searching. When I search (top-right corner) for “Log4J” the first result is our official statements made at the time the vulnerability was discovered:

> [@SonarQube, SonarCloud, and the Log4J vulnerability](https://community.sonarsource.com/t/sonarqube-sonarcloud-and-the-log4j-vulnerability/54721):
>
> Update 21 December 2021 Hi all, We’ve just [released](https://community.sonarsource.com/t/sonarqube-8-9-6-lts-and-9-2-4-released/55359) SonarQube 8.9.6 LTS and 9.2.4 (Latest) to eliminate confusion and avoid false-positive from vulnerability scanning tools in regards to: [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046), [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) and [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105). In these new versions, the Elasticsearch component is updated to its latest bugfix version, 7.16.2, which updates the packaged Log4J dependency to 2.17. Note: Although our security researchers have not found the previous SonarQube LTS (8.9.3, 8.9.4 or 8.9.5…

&nbsp;  
HTH,  
Ann