search cancel

CVE-2021-44228 - log4j vulnerability and ESP dSeries Workload Automation DE

book

Article ID: 230329

calendar_today

Updated On:

Products

CA Workload Automation DE CA Workload Automation DE - Business Agents (dSeries) CA Workload Automation DE - System Agent (dSeries) CA Workload Automation DE - Scheduler (dSeries)

Issue/Introduction

Apache Log4j 2 remote code execution vulnerability that was recently reported to Apache.  CVE identifier CVE-2021-44228 has been assigned to this vulnerability.  This is a Critical vulnerability, and exploit code is in the wild.  The Log4j team has addressed the vulnerability in Log4j 2.15.0. 

Log4j Versions Affected: all versions from 2.0-beta9 to 2.14.1

CVE-2021-44228 Description: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default.

dSeries is using log4j 2.11.0 version in migration folder of server in 12.1 to 12.3 releases from the supported versions

New log4j version 2.17 is not needed because ESP dSeries does not use Thread Context Map (MDC) as described in this medium severity CVE.

Note: Log4j versions 1.x are not affected by this vulnerability.

Environment

https://support.broadcom.com/download-center/solution-detail.html?aparNo=99111315&os=MULTI-PLATFORM

Environment : All Platforms

Release affected: 12.1,12.2,12.3

Component: ESP Workload Automation DE

Resolution

DE Server / Web Client Patches:

ESP Workload Automation DE and Web Client patches to address Log4j Vulnerability patched with log4j.2.16 jar version. 

Web Client (12.3.00.00-2321) – 99111317  --  https://support.broadcom.com/download-center/solution-detail.html?aparNo=99111317&os=MULTI-PLATFORM

DE (dSeries) Server  – 99111315   --  https://support.broadcom.com/download-center/solution-detail.html?aparNo=99111315&os=MULTI-PLATFORM

Web Client Patch is only for r12.3 version, other supported web client versions are not affected (Normal Cumulative patch).

DE (dSeries) Server Patch is for r12.1, r12.2, r12.3 supported DE versions. No need to shutdown the server.  Apply to both primary and standby servers for High Availability installations.

Mitigation/Workaround:

Please follow the below steps to mitigate the problem as suggested in the https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

Users may use a modified log4j-core-2.11.0.jar.  The JndiLookup.class has been removed from the original jar.  The jar has been attached to this KD (scroll to the bottom).   

To use the modified jar:

1. Navigate to <DE_install_directroy>/migration/lib

2. Delete/move current log4j-core-2.11.0.jar from the directory (move to some other location).

3. Download the attached jar and rename it from "log4j-core-2.11.0_1639670761625.jar" to log4j-core-2.11.0.jar

4. Copy the new log4j-core-2.11.0.jar to <DE_install_directroy>/migration/lib

5. Follow the above steps and copy the new modified jar to these (2) locations as well

<DE_install_directroy>/migration/12.0-lib
<DE_install_directroy>/migration/11.3-lib

6. No restart of DE service is needed.

Note: It is recommended to take backup of DE install directory before making any changes.

For users who may wish to manually modify the log4j-core-2.11.0.jar (remove JNDI lookup class), follow these steps

DE Server:

In Linux/UNIX:

1. Navigate to:

<DE_install_directroy>/migration/lib

2. Run this command:

zip -q -d log4j-core-2.11.0.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

Follow the above steps for these directory as well

<DE_install_directroy>/migration/12.0-lib
<DE_install_directroy>/migration/11.3-lib

In Windows:

1. Create a new folder say “log4j_temp” in C: or D:

2. Copy the log4j-core-2.11.0.jar from <DE_install_directroy>/migration/lib folders to newly created “log4j_temp”

3. Open command prompt and navigate to log4j_temp, then issue this command:

jar -xf log4j-core-2.11.0.jar

4. The above command will the extract several directory and files inside log4j_temp.  Go to  path "org/apache/logging/log4j/core/lookup/", and delete JndiLookup.class

5. Next, go back to log4j_temp, and delete the log4j-core-2.11.0.jar.

6. Repack the jar by this command under log4j_temp folder in command prompt

jar -cf log4j-core-2.11.0.jar *

7. A new log4j-core-2.11.0.jar will be created and copy the newly created jar under migration lib folder : <DE_install_directroy>/migration/lib.

Follow the above steps for these directory as well

<DE_install_directroy>/migration/12.0-lib
<DE_install_directroy>/migration/11.3-lib

Navigate to above mentioned directories and perform steps 2 to 7.

 

Additional Information

Note: Restart of DE (ESP dSeries) is not needed.  Migrate script is only used when actual migration of DE server is done.

Workload Automation Agents are not impacted by this vulnerability. 

Attachments

log4j-core-2.11.0_1639670761625.jar get_app