Is xenforo vulnerable to log4j?

[James T]

Many sites are announcing fixes to address the Log4j vulnerability. Is there a fix for xenforo?

 

[sbj]

Sadly, after 2 years I had to restart my elasticsearch service, but it is for a good cause .

 

[djbaxter]

What is the CLI command to restart elasticsearch on CENTOS?

 

[Nirjonadda]

What is the CLI command to restart elasticsearch on CENTOS?

sudo systemctl restart elasticsearch.service

 

[Kirby]

Depends on your init-System, for systemd it is usually systemctl restart elasticsearch[.service]

 

[sbj]

For me systemctl restart elasticsearch did the trick. To check status systemctl status elasticsearch

 

[bzcomputers]

What is the CLI command to restart elasticsearch on CENTOS?

You can now run "yum update" on CENTOS to get the patched 7.16.1 version of Elasticssearch released today.

 

[Xon]

New CVE-2021-45046

It looks like ElasticSearch's practice of completely removing JndiLookup class file means it isn't vulnerable.

 

[gerryvz]

What is the CLI command to restart elasticsearch on CENTOS?

and for Ubuntu:

/etc/init.d/elasticsearch restart

 

[motowebmaster]

Although I recently upgraded from 7.16.0 to 7.16.1, I'm thinking about building a new ES instance anyway. Due to all of the comments on this page:

Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31

Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary...

discuss.elastic.co

 

[Deleted member 232995]

Our hoster wrote us that the workaround does not help... Is there any more feedback?


And referred me to this link

CVE - CVE-2021-45046

 

[Xon]

ElasticSearch 7.16.1 and 6.8.21 completely remove the JndiLookup class which is the recommended workaround for the latest CVE.

 

[Masetrix]

It'll affect those using Redis also. Which I think is quite a few XenForo owners.

Nope

Security Notice: Apache Log4j2 CVE-2021-44228 - Redis

Redis security notice for Apache Log4j2 CVE-2021-44228.

redis.com

@all You should install log4j 2.16 as soon as possible, log4j 2.15.0 is still vulnerable!

https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0woz4

 

[Masetrix]

another little help...

GitHub - mergebase/log4j-detector: A public open sourced tool. Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instances that are hi

A public open sourced tool. Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J ins...

github.com

 

[djbaxter]

ElasticSearch 7.16.1 and 6.8.21 completely remove the JndiLookup class which is the recommended workaround for the latest CVE.

how do I upgrade elasticsearch (current version 7.10.2) to 7.16.1? i.e., what are the commands to run in Terminal - or is there a better way to do the upgrade?

 

[duderuud]

Depends on your distro. Usually it is the standard update command for your distro.

 

[Nirjonadda]

how do I upgrade elasticsearch (current version 7.10.2) to 7.16.1? i.e., what are the commands to run in Terminal - or is there a better way to do the upgrade?

sudo yum update --enablerepo=elasticsearch elasticsearch

 

[bzcomputers]

Be aware once you update Elastricsearch it took about a day for XenForo to report the new version was installed. Likely due to a daily cron update required to check versioning.

 

[motowebmaster]

One needs to restart elasticsearch after the upgrade. How you do it depends on the installation procedure you followed.

 

[bzcomputers]

One needs to restart elasticsearch after the upgrade. How you do it depends on the installation procedure you followed.

Assuming you were talking to me. Restarting Elasticsearch still did not update version shown in admincp.

 

[Nirjonadda]

Assuming you were talking to me. Restarting Elasticsearch still did not update version shown in admincp.

Do reboot the server and version information will be updated immediately.