A vulnerability has been publicly disclosed in Apache Log4j 1.2. The vulnerability has been assigned the identifier CVE-2021-4104 with a CVSS score of “High”.
All versions of Data Platform include Log4j 1.2 components, and thus are potentially exposed to this vulnerability. This article describes the potential impact of the vulnerability on Data Platform and options for mitigation.
The National Vulnerability Database describes the CVE-2021-4104 vulnerability at https://nvd.nist.gov/vuln/detail/CVE-2021-4104 as follows (current as of Dec 30, 2021):
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.
The default configuration of Data Platform does not meet the preconditions described for the vulnerability to be exploited.
The following steps should be taken on all computers on which Data Platform components are installed:
Audit your logging configuration to ensure it has no JMSAppender configured.
Logging configuration is stored in files named log4j.xml. Such configuration would be highly unusual for a Data Platform installation, and would only appear if a non-default configuration has been applied.
Perform the following steps to upgrade to the latest version of Data Platform. This is the typical upgrade process used for regular monthly releases, as documented in the Data Platform Release Notes.
Also see the following pages:
2021-12-30 12:53 PM CST: Initial article.
2022-01-03 7:50 PM CST: Add link to Data Platform 5.5.48 release notification.
2022-02-01 11:20 PM CST: Update to clarify that not all instances of the Log4j component have been updated in the Data Platform 5.5.48 release.
My organization runs Data Platform on an isolated network that does not have internet access. What is the process to install the patch or otherwise upgrade to 5.5.48 for an offline network?
@scott_alexande - This is possible by following the "offline synchronization" steps described on page 25 of the Data Platform Administrator Guide: https://docs.flexera.com/dataplatform55/Data_Platform_Administrator_Guide_5.5_e.pdf
Are there plans to upgrade to log4j 2.17.1? My cyber security organization considers CVE-2021-44228 a severity 4 vulnerability that must be patched in Data Platform by May 2022
I came back to this thread to check about:
In general, every potential vulnerability needs to be seen in the specific product context, whether the product exposes a specific vulnerability and thus makes it reachable.
The only CVE identifier the Apache Log4j version 2.17.1 fixes compared to the 2.17.0 release is CVE-2021-44832 (see ). This issue referenced by the CVE identifier CVE-2021-44832 requires that a potential attacker is able to construct a malicious Log4j configuration (details also in ). In the default configuration of our deployment this exposure is not the case.
To become theoretically exploitable, after deployment someone needs to alter the configuration directly (“with permission to modify the logging configuration file” ) or potentially alter it through a Man-in-the-Middle (MitM) scenario in case a configuration is loaded remotely. However, for both points to be reachable, security best practices need to be severely violated as in the first case only trusted personnel should be able to alter such configurations (such persons can typically already execute arbitrary code anyway) and in the latter case any remote loading of a configuration has to be properly protected from tampering and thus the MitM path becomes ineffective.
In essence, the 2.17.0 version is already properly protecting the deployed product when compared to the 2.17.1 version as there is seemingly no valid exploitation scenario for CVE-2021-44832 exposed in our case.
With that said, we understand that some of our customers have certain security requirements that require further patching. We're investigating the effort to upgrade the log4j components in Data Platform to version 2.17.1 or later in one of the future Data Platform releases. We'll update this blog post when we have more clarity in terms of expected timeline and additional details.
Are there any updates on this? we are getting CVE-2021-44832 for 2.17.0 as well. I see this discussion occurred back in April and new releases are coming out monthly. Please update
The following Data Platform patch includes an update to Pentaho Business Intelligence which in turn includes an update to Log4J 2.17.1: Data Platform 2022 - 5.5.54 Patch (June 2022)
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.