GitHub’s Log4j Response: Patching Enterprise Server and Assessing Cloud Exposure
When CVE-2021-44228 in the Apache Log4j library became public on December 9, 2021, GitHub activated its incident response process to map the framework’s usage across its products and infrastructure. The company also published a security advisory and issued Dependabot alerts to help the broader community identify affected code.
Enterprise Server Mitigations
In GitHub Enterprise Server’s recommended configuration, the vulnerability is only reachable by authenticated users. Instances running without private mode may expose the flaw to unauthenticated users as well. GitHub offered two paths for securing affected instances:
- Upgrade to a patched release: 3.3.1, 3.2.6, 3.1.14, or 3.0.22.
- Apply a hotpatch to an existing instance following the documented hotpatch procedure, which avoids a maintenance window.
GitHub identified Elasticsearch as the only known Log4j exposure in Enterprise Server. The configuration-based mitigation shipped in the December 13 patch releases was validated internally against CVE-2021-44228, CVE-2021-45046, and other published variants. That approach follows Elasticsearch’s mitigation guidance and did not require an immediate jump to Log4j 2.16.
Cloud and GitHub.com Status
Mitigations for Elasticsearch usage within GitHub.com and GitHub Enterprise Cloud were completed on December 14. GitHub validated that those protections cover both CVE-2021-44228 and CVE-2021-45046 in the context of Elasticsearch’s Log4j integration, with no exploitation detected.
Beyond Elasticsearch, GitHub continued investigating other third-party services in its infrastructure, rolling out remediations and vendor recommendations as they became available. Telemetry monitoring for signs of exploitation remained active, and no successful attacks were reported.
Later Log4j Variants and Enterprise Server Updates
As new Log4j vulnerabilities emerged, GitHub’s security lab reviewed product exposure and evaluated the effectiveness of earlier mitigations. No additional risk or exposure was identified internally or across products.
In January 2022, GitHub released Enterprise Server versions 3.3.2, 3.2.7, 3.1.15, and 3.0.23, updating the bundled Log4j dependency to version 2.17.1. The upgrade was folded into the normal release cycle; the existing configuration-based mitigation continued to protect against CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. The newer Log4j version was intended to reduce false positives from file-based vulnerability scanners.
