CVE-2021-44228 - log4j vulnerability and client software Jaspersoft studio

Products

• Clarity PPM On Premise
• Clarity PPM SaaS

Issue/Introduction

 Is Jaspersoft studio vulnerable to CVE-2021-44228 - log4j ? If yes, can you share the mitigation steps?

Environment

Clarity 16.0 and Jaspersoft studio 7.9

Resolution

Jaspersoft studio 7.9 is listed as one of the Tibco softwares with the vulnerable log4j code. The resolution for Jaspersoft 7.9:

1. Close Jaspersoft studio application
   
   
2. Remove the following files from the [JSS_PRO]/jrio/jrio/WEB-INF/lib folder:
   log4j-api-2.8.2.jar
   log4j-core-2.8.2.jar
   log4j-jcl-2.8.2.jar
   log4j-jul-2.8.2.jar
   log4j-slf4j-impl-2.8.2.jar
   
   
3. Add the following files to the [JSS_PRO]/jrio/jrio/WEB-INF/lib folder:
   log4j-api-2.17.0.jar
   log4j-core-2.17.0.jar
   log4j-jcl-2.17.0.jar
   log4j-jul-2.17.0.jar
   log4j-slf4j-impl-2.17.0.jar
   
   
4. Open Jaspersoft studio application.

Reference: Apache Log4j Vulnerability Update for Jaspersoft Products

The log4j vulnerability mitigations for Clarity and Jaspersoft 7.8 server including the recommended log4j jar file (2.17.0) is found here - CVE-2021-44228 - log4j vulnerability and Clarity

Note: Jaspersoft studio 7.1 is not containing the vulnerable log4j code, and no actions are required.