Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docker-compose.yml updates for Elasticsearch security #161

Open
lwrubel opened this issue Dec 13, 2021 · 0 comments
Open

docker-compose.yml updates for Elasticsearch security #161

lwrubel opened this issue Dec 13, 2021 · 0 comments

Comments

@lwrubel
Copy link
Collaborator

lwrubel commented Dec 13, 2021

Address log4j2 remote code execution vulnerability, acknowledging that, according to ElasticSearch, "Elasticsearch is not susceptible to remote code execution with this vulnerability due to our use of the Java Security Manager. Elasticsearch on JDK8 or below is susceptible to an information leak via DNS which is fixed by a simple JVM property change. The information leak does not permit access to data within the Elasticsearch cluster."

Add -Dlog4j2.formatMsgNoLookups=true to elasticsearch docker container environment variables in docker-compose.yml files per the Elastic Search recommendations above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant