ES7.12修复log4j漏洞 详细操作及命令

下载log4j2.17.2

官网下载 或者 点击 下载

查询log4j jar包信息

es 目录下查找log4jjar包，可以看到有5个jar包需要替换

[root@iZ1pg01eq60gutiom4u5biZ elasticsearch]# find . -name log4j*
./config/log4j2.properties
./lib/log4j-core-2.11.1.jar
./lib/log4j-api-2.11.1.jar
./modules/x-pack-core/log4j-1.2-api-2.11.1.jar
./modules/x-pack-identity-provider/log4j-slf4j-impl-2.11.1.jar
./modules/x-pack-security/log4j-slf4j-impl-2.11.1.jar

上传并替换jar包并修改jar包所有者

上传需要替换的jar包

[root@iZ1pg01eq60gutiom4u5biZ elasticsearch]# ll /home/log4j2.17.2
total 2392
-rw-r----- 1 scapp scapp  303443 Jan  2 01:00 log4j-1.2-api-2.17.2.jar
-rw-r----- 1 scapp scapp  302511 Jan  2 01:00 log4j-api-2.17.2.jar
-rw-r----- 1 scapp scapp 1811090 Jan  2 01:00 log4j-core-2.17.2.jar
-rw-r----- 1 scapp scapp   24248 Jan  2 01:00 log4j-slf4j-impl-2.17.2.jar

到指定目录替换jar包并更改jar包的所有者为es启动用户

mv log4j-core-2.11.1.jar log4j-core-2.11.1.jarbak
mv log4j-api-2.11.1.jar log4j-api-2.11.1.jarbak
复制
cp  /home/scapp/deploy_backup/20220414/log4j2.17.2/log4j-api-2.17.2.jar  .
cp  /home/scapp/deploy_backup/20220414/log4j2.17.2/log4j-core-2.17.2.jar .
修改所有人
chown es:es log4j-core-2.17.2.jar log4j-api-2.17.2.jar

备份jar包
mv ./modules/x-pack-core/log4j-1.2-api-2.11.1.jar  ./modules/x-pack-core/log4j-1.2-api-2.11.1.jarbak
mv ./modules/x-pack-identity-provider/log4j-slf4j-impl-2.11.1.jar ./modules/x-pack-identity-provider/log4j-slf4j-impl-2.11.1.jarbak
mv ./modules/x-pack-security/log4j-slf4j-impl-2.11.1.jar ./modules/x-pack-security/log4j-slf4j-impl-2.11.1.jarbak
复制jar包
cp  /home/log4j2.17.2/log4j-1.2-api-2.17.2.jar modules/x-pack-identity-provider/
cp  /home/log4j2.17.2/log4j-slf4j-impl-2.17.2.jar  modules/x-pack-identity-provider/
cp  /home/log4j2.17.2/log4j-slf4j-impl-2.17.2.jar  modules/x-pack-security/
修改jar包归属
chown es:es modules/x-pack-identity-provider/log4j-1.2-api-2.17.2.jar
chown es:es modules/x-pack-identity-provider/log4j-slf4j-impl-2.17.2.jar
chown es:es modules/x-pack-security/log4j-slf4j-impl-2.17.2.jar
查看jar包名称及归属是否正确
ll  modules/x-pack-identity-provider/
ll  modules/x-pack-identity-provider/
ll modules/x-pack-security/

确保jar包替换正确且 都归属es启用用户

启动并验证

重启es服务不报错 ，且服务可访问即可