Vulnerability Update - Log4J2 / Log4Shell

Dec 13, 2021

We became aware of a critical level vulnerability in Log4J2 known as Log4Shell (CVE-2021-44228) from Apache, and started to investigate and develop a patch to overcome this on top of our original November 21 release

Dec 14, 2021

RELEASE - We issued a patch release (2021-11-25.1) to our original November 2021 release to overcome the CVE-2021-44228 vulnerability, which can be downloaded from our Customer Portal site for Windows and Linux installers, or through DockerHub for those using that approach. Our AMIs through the AWS Marketplace have been updated too.

Dec 15, 2021

Unfortunately, Apache have found a second vulnerability (CVE-2021-45046) involving Log4J2. Their initial fix for Log4Shell, version 2.15.0 was added to our 2021-11-25.1 release, however they have advised that this did not address all issues in non-default configurations and could be abused for DoS- denial of service attacks through malicious input. The Apache Software Foundation (ASF) have pushed out a new fix for Log4J2, 2.16.0.

We have received this fix and are actively working on providing a 2nd patch to our November 21 release to mitigate against this. After successful testing, the new patch was released by close of play Dec 16, 2021. This has been uploaded to our Customer Portal, DockerHub and AWS Marketplace areas for download.

IMPORTANT - In addition to the new (CVE-2021-45046) vulnerability, the mitigation advice provided by Apache has also changed. Please revisit the Guidance section below if you have already applied mitigations rather than upgrading. We have left the old guidance on the page for transparency however it has been crossed through.

Dec 16, 2021

RELEASE - Today we released a 2nd patch (2021-11-25.2) to our original November 21 release, to address the latest Apache vulnerability (CVE-2021-45046). This can be downloaded from either our Customer Portal site for Windows and Linux installers, or through DockerHub for those using that approach. Our AMIs obtained from the AWS Marketplace have been updated too.

As mentioned in yesterdays update, Apaches mitigation advice has changed, therefore please ensure you review the changes described in the Guidance section below, and take any nessisary actions needed. If you have any active instances of the dashboard running, but they are not actively in use (maybe for trials or where licences have expired), we always recommend uninstall these when they are no longer needed.

We are not currently aware of any compromises or malicious activity involving our products or services.

Dec 16, 2021

We have established that releases prior to May 2021 do not contain the vulnerable libraries so you would not need to follow the mitigation advice. However we would still recommend you upgrade to take advantage of other less critical security fixes.

IMPORTANT - Before performing any upgrades to our November patched release, its imperative that you first read through the Release Notes fully, and that of other releases inbetween your current version and the one you are upgrading too. This helps ensure you are fully aware of the system changes and any additional configuration change you may need to make during the upgrade process.

Dec 18, 2021

Unfortunately Apache have issued a further library update (2.17.0) for the Log4J2 library, as a further vulnerability CVE-2021-45105 has been found with version 2.16.0. The latest issue relates to denial of service not remote acccess as was the case with the previous vulnerabilities. We included version 2.16.0 in our 2nd patched release only last week (2021-11-25.2) on Dec 16, 2021.

We are currently working on producing another patched release (2021_11_25.4) to incorporate the new 2.17.0 library, and subject to successful testing we expect to issues this by CoB on Monday Dec 20, 2021

Dec 20, 2021

RELEASE - Today we released another patch (2021-11-25.4) to our original November 21 release - this addresses Apache vulnerability (CVE-2021-45105). This can be downloaded from either our Customer Portal site for Windows and Linux installers, or through DockerHub for those using that approach. Our AMI's which are available on the AWS Marketplace, have been updated too.

IMPORTANT - As a precaution, we have removed the Apache Drill and Firebolt JDBC drivers from Tomcat until we have hear back from them to clarify if they carry the Log4J2 vulnerabilities or not. If you are currently using these, after upgrading you will need to add them yourself under tomcat/custom_jdbc_drivers and ensure their safety.

If you happened to locate and upgrade to a 2021-11-25.3 release today (which was intended for internal testing only), we recommend upgrading 2021-11-25.4 to ensure you are aligned with the very latest release.

For those who have previously upgraded to either our original November release, or the patched .1, .2 or .3 versions, we highly recommend that you upgrade to the .4 version at your earliest opportunity.

Jan 4, 2022

A further vulnerability (CVE-2021-44832) has been reported which relates to a very specific type of configuration which we do not use in the dashboard (JDBC Appender with a JNDI LDAP data source URI). Our January 22 release will contain the very latest Log4J 2 library but we will not be issuing this version in an emergency patch before then because it is not exploitable in our configuration. It is still possible to manually update the libraries in the manner described previously if you are especially concerned, but we do not specifically recommend this.

• September 2021, October 2021 and November 2021 (initial release):

  • Edit the file Dashboard/service/install_jvm_service.bat and add

  • ;-Dlog4j2.formatMsgNoLookups=true

  • to the end of the –JvmOptions line (inside the speech marks)

  • The configuration tool will need to be re-run to remove and reinstall the service.

•  Edit the file Dashboard/tomcat/bin/setenv.sh and add

• (space)-Dlog4j2.formatMsgNoLookups=true

• to the end of the export JAVA_OPTS line (inside the speech marks).

• When Tomcat is restarted this will take effect.

• Prior to September 2021 release:

  •  Edit the file Dashboard/tomcat/bin/service.bat and add

  •  ;-Dlog4j2.formatMsgNoLookups=true

  • to the end of the –JvmOptions line (inside the speech marks)

  • The configuration tool will need to be re-run to remove and reinstall the service.