CVE-2021-44228 has been determined to impact vSphere ESX Agent Manager SDK part of vSphere Management SDK via the Apache Log4j open source component it ships. This vulnerability and its impact on VMware products are documented in the following VMware Security Advisory (VMSA), please review this document before continuing:
To apply the workaround for CVE-2021-44228 to vSphere ESX Agent Manager SDK perform the following steps:
cp eam-sample.war eam-sample.war.bak
unzip eam-sample.war -d /tmp/outputdir; \ zip -q -d /tmp/outputdir/WEB-INF/lib/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class; \ jar cMf eam-sample.war -C /tmp/outputdir/ .
Note: After you are done, delete the /tmp/outputdir/ directory. We removed the "rm -rf" command from the end of the code block above to prevent any rm -rf mistakes.
To verify the workaround for CVE-2021-44228 has been correctly applied to vSphere ESX Agent Manager SDK perform the following steps:
unzip eam-sample.war -d /tmp/outputdir 2>&1 1>/dev/null; \ find /tmp/outputdir -type f -name "log4j-core-*.jar" -exec sh -c "zipinfo -1 {} | grep JndiLookup.class && echo {}" \;
Note: successful output in the command prompt will look similar to the following:
user@ubuntu:~/Documents/eam70u3/SDK/eam$ unzip eam-sample.war -d /tmp/outputdir 2>&1 1>/dev/null; \ > find /tmp/outputdir -type f -name "log4j-core-*.jar" -exec sh -c "zipinfo -1 {} | grep JndiLookup.class && echo {}" \; user@ubuntu:~/Documents/eam70u3/SDK/eam$
Note: a war file which did not have the workaround applied with have output similar to:
user@ubuntu:~/Documents/eam70u3/SDK/eam$ unzip eam-sample.war.bak -d /tmp/outputdir 2>&1 1>/dev/null; \ > find /tmp/outputdir -type f -name "log4j-core-*.jar" -exec sh -c "zipinfo -1 {} | grep JndiLookup.class && echo {}" \; org/apache/logging/log4j/core/lookup/JndiLookup.class /tmp/outputdir/WEB-INF/lib/log4j-core-2.11.0.jar user@ubuntu:~/Documents/eam70u3/SDK/eam$
To revert the workaround for CVE-2021-44228 to vSphere ESX Agent Manager SDK perform the following steps:
cp eam-sample.war.bak eam-sample.war
Changelog: