Is AAI affected by log4j 1.2.x vulnerability 1.2 CVE-2021-4104?

Products

• Automation Analytics & Intelligence

Issue/Introduction

Is AAI affected by log4j 1.2.x vulnerability 1.2 CVE-2021-4104?

Environment

Release : 6.4.x

Component : AUTOMIC AUTOMATION INTELLIGENCE ENGINE

Resolution

The security bulletin for CVE-2021-4104 states that this only affects Log4j 1.2 when specifically configured to use JMSAppender.

CVE-2021-4104 Description: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

 

AAI Engineering has confirmed AAI is not configured to use JMSAppender, therefore AAI is not affected by this vulnerability, despite the presence of Log4j 1.2 jar files.