Search Guard for Elasticsearch 6.8.21 CVE-2021-44228

[marcopolo]

Dear Search Guard Team,

regarding your annoncement

Update on the Log4J2 RCE Vulnerability - CVE-2021-44228

You probably already have heard of the critical Log4J2 vulnerability which was disclosed a couple of days ago. Search Guard solely depends on the Log4j2 component shipped by Elasticsearch. Thus, the vulnerability is only fixable by updating Elasticsearch or by applying the mitigations recommended by Elasticsearch: Independently, we are doing our own security tests to double-check the recommendations by Elasticsearch. In the meantime, we are recommending to apply the mitigation of setting the…

Could you please provide a SearchGuard 25.6 Build for Elasticsearch 6.8.21?

This version includes some log4j fixes

Elasticsearch version 6.8.21 | Elasticsearch Guide [6.8] | Elastic