Apache Log4j Security Vulnerabilities -- PIM R12.8 and R12.8 SP1

Products

• CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

Log4j vulnerabilities - Do these have an impact on R12.8 and R12.8 SP1

Environment

Release : 12.8, 12.8 SP1

Component : CA ControlMinder

Cause

If R128 and R12.8 SP1 are impacted, a fix for the same is required.

Resolution

Please refer to Apache Log4j Security Vulnerabilities

As per Apache, "Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2."

Mitigation
Log4j 1.x mitigation
Log4j 1.x is not impacted by this vulnerability.

PIM R12.8 and PIM R12.8 SP1 uses Log4j 1.2.8 version, hence this version of PIM is not impacted.