CVE-2021-44228: Log4j vulnerability impact on Code Insight
CVE-2021-44228: Log4j vulnerability impact on Code Insight
Summary:
A vulnerability identified as CVE-2021-44228 has been reported in the Apache Log4j library. This vulnerability may allow for remote code execution in susceptible products.
Description:
Code Insight v6 and v7 are not impacted by CVE-2021-44228.
The table below lists Code Insight v6 and v7 components, and the logging frameworks used in those components.
Code Insight v6
Code Insight v7
Remarks
Core Server
Scan Server
Log4j 1.x
Log4j 1.x
Log4j 1.x is not affected by CVE-2021-44228.
Regarding CVE-2021-4104, in Code Insight v6 and v7, JMSAppender is not enabled and used in the application. Therefore, Code Insight isnot impacted by CVE-2021-4104.
Code Aware (used in scans via scan server, plugins, and standalone scanner)
Log4j v2.x files are shipped but not configured and used. *Please see the note below.
Plugins (only for Code Insight v7)
Not Applicable
Apache Commons Logging 1.x
Code Insight Standalone Scanner (only for Code Insight v7)
Not Applicable
Apache Commons Logging 1.x
This standalone scanner has been made available from 2021 R3.
*Note about SLF4J: SLF4J is a wrapper logging framework which can use one of the logging implementations like logback, log4j, java.util.logging etc.
In Code Aware module we use SLF4 logging, which in turn points to and uses native implementation of logback library.
Log4j 2 jar files are shipped and present in the Code Insight install location, however Log4j 2x library is neither
configured to be used with SLF4j
nor directly referenced in the code.
Hence despite the presence of Log4j 2 files in the Code Insight application, it can be confirmed that Log4j 2 libraries are not used for logging.
Resolution:
No fix is required.
Workaround:
As Code Insight has no dependency on the included Log4j 2 libraries, these can be deleted using the instructions below:
Remediation Steps for Code Insight v7.x -
Steps to remove Log4j 2 files from Code Insight in case of standalone installation (Core & Scan server in the same machine):
Log in as the user who performed the Code Insight installation.
Shut down the Code Insight application. (or stop the service if configured in service mode)
Navigate to "$Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib"
Delete files "log4j-api-2.11.1.jar" and "log4j-core-2.11.1.jar" from the directory
Delete the codeaware.war from “$Codeinsight_Install_Location\tomcat\webapps folder”.Following steps removes log4j jar files from Code Aware component which is used by plugins or standalone scanner for scan.
Navigate to "$Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes". Take the backup of "codeaware-embedded-<Version>.zip" file
Navigate to Linux: "$Codeinsight_Install_Location/7-zip/lnx64" or Windows: "$Codeinsight_install_location\7-zip\win64"
Execute below command from terminal or command prompt to remove "log4j-api-2.11.1.jar" and "log4j-core-2.11.1.jar" from the "codeaware-embedded-<Version>.zip". This command used the “7z” tool supplied with application to remove files with in the zip file
Linux:- ./7z d Codeinsight_Install_Location/tomcat/webapps/codeinsight/WEB-INF/classes/codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
Windows: 7z.exe d Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes\codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
Start the CodeInsight application
Steps to remove Log4j 2 files from Code Insight in case of Core and Scan servers installed on
different machines:
Scan Server(s): Perform these steps on each scan server.
Log in as the user who performed the Code Insight installation.
Shutdown the Code Insight scanner application (or stop the service if configured in service mode).
Navigate to "$Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib".
Delete files "log4j-api-2.11.1.jar" and "log4j-core-2.11.1.jar" from the directory.
Delete the codeaware.war from “$Codeinsight_Install_Location\tomcat\webapps folder”.
Start the Code Insight scanner server. (Perform this step after completing steps on core server)
Core Server:
Log in as the user who performed the Code Insight installation.
Shutdown the Code Insight core application (or stop the service if configured in service mode). Following steps removes log4j jar files from Code Aware component which is used by plugins or standalone scanner for scan.
Navigate to "$Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes". Take the back up of " codeaware-embedded-<Version>.zip" file.
Navigate to Linux: "$Codeinsight_Install_Location/7-zip/lnx64" or Windows: "$Codeinsight_install_location\7-zip\win64".
Execute below command from terminal or command prompt to remove "log4j-api-2.11.1.jar" and "log4j-core-2.11.1.jar" from the "codeaware-embedded-<Version>.zip". This command used the “7z” tool supplied with application to remove files with in the zip file.
Linux:- ./7z d Codeinsight_Install_Location/tomcat/webapps/codeinsight/WEB-INF/classes/codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
Windows:- 7z.exe d Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes\codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
Start the Code Insight core server.
Scan plugin and Standalone scanner changes:
The following steps are to be performed for cases in which the scan plugins or standalone scanner are in use for scanning. Since the plugins and standalone scanner download “codeaware-embedded-<Version>.zip” during scan, you are likely to find old references to the log4 jars on these machines. The following steps will delete all references to this file.
If no plugins or standalone scanner are in use, the following stepscan be skipped.
On the machine(s), where the plugin or standalone scanner is configured, locate the user who performed the Code Insight installation or executed the plugin or standalone scanner.
Delete the directory "$user_dir/.codeinsight". Refer the example below:
Linux: "/home/<user>/.codeinsight"
Windows: "C:/Users/<user>/.codeinsight"
Note:
a) ".codeinsight" directory in case of Linux would be a hidden directory (perform “ls -al” to list .codeinsight directory)
b) In case of Jenkins or Bamboo plugins, if remote agent nodes are configured, above step has to be done on the remote agent nodes.
Remediation Steps for Code Insight v6.x -
Steps to remove log4j v2.x files from Code Insight in case of standalone installation (Core & Scan server in the same machine).
Log in as the user who performed the Code Insight installation.
Shut down the Code Insight application. (or stop the service if configured in service mode)
Navigate to "$Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib".
Delete files "log4j-api-2.11.1.jar" and "log4j-core-2.11.1.jar" from the directory.
Delete the codeaware.war from “$Codeinsight_Install_Location\tomcat\webapps folder”.
Start the Code Insight application.
Steps to remove Log4j 2 files from Code Insight in case of Core and Scan servers installed on different machines.
Scan Server(s): Perform these steps on each scan server.
Log in as the user who performed the Code Insight installation.
Shutdown the Code Insight scanner application (or stop the service if configured in service mode).
Navigate to "$Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib".
Delete files "log4j-api-2.11.1.jar" and "log4j-core-2.11.1.jar" from the directory.
Delete the codeaware.war from “$Codeinsight_Install_Location\tomcat\webapps folder”.
Thanks for the question Mei. Code Insight v7 will have log4j updated for the 2022 R1 release. Code Insight v6 is still being assessed for impact of performing the Log4j 1x to 2.x update. We will post an update once we have more information.
