The log4j Vulnerability (CVE-2021-44228)

Data Security

Opensolr is not vulnerable to CVE-2021-44228. The entire platform was patched on December 11, 2021, across every Solr version we host.

01 · What the vulnerability is

CVE-2021-44228 is a critical flaw disclosed in December 2021 in the log4j logging library. If a vulnerable application logs text that a user controls, an attacker can craft that text so it is executed as code on the server. It was not a Solr flaw: log4j is used by a large part of the Java ecosystem, and Solr is one of many applications that log through it.

02 · Is Opensolr affected

No. The patch was applied across the whole Opensolr ecosystem on December 11, 2021, and it covers every Solr version running on the platform, from the oldest to the newest. Your hosted indexes were protected then and remain protected.

Old Solr versions are covered too

The fix is in log4j, not in Solr, so it protects an index on Solr 4 exactly as it protects one on Solr 9.

Nothing was required from you

Managed environments were patched by us. There was no customer action and no downtime window to book.

Need a different Solr version

You can create a new index on a newer Solr version from your control panel at any time. Migrations of an existing index can be done by our team as paid work.

03 · Your own Java applications

If you run Java services of your own, inside or outside Opensolr, patch or update log4j there as well. The Apache log4j security page lists the affected versions and the mitigation steps.

Apply vendor patches promptly

The window between a disclosure and mass scanning is now hours, not weeks.

Watch the official channels

Solr and log4j both publish security advisories. They are the first place a real fix appears.

Ask us about your indexes

If a security review asks you what Opensolr did about a specific CVE, write to us and we will answer in writing. Our posture is documented in the Trust Center.