2 years ago

Category: Kubernetes, github

We know that many of you are working hard on fixing the new and serious Log4j 2 vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-44228, which has a 10.0 CVSS score. This vulnerability in Log4j 2, a very common Java logging library, allows remote code execution, often from a context that is easily available to an attacker.

The configuration for the docker scan command previously shipped in Docker Desktop versions 4.3.0 and earlier unfortunately do not pick up this vulnerability on scans.

docker scan elastic/logstash:7.13.3 or to cut out all the other vulnerabilities docker scan elastic/logstash:7.13.3 | grep 'Arbitrary Code Execution'

A number of the Docker Official images do contain the vulnerable versions of Log4j 2.