Vantage -CVE-2021-44228/CVE-2021-45046-Log4j vulnerability

Products

• Vantage Storage Resource Manager

Issue/Introduction

A scan on the devices shows a vulnerability in CA Vantage Windows Client regarding the CVE-2021-44228 / CVE-2021-45046 - Log4j JndiLookup class mitigation -CVE-2021-44228/CVE-2021-45046-Log4j JndiLookup class mitigation 1.0.0 custom #######-scfile_eAm2Gy ###### AUDIT_POWERSHELL value_data:'^@CLASS_FILTER@ not found$' #####. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.
This could allow attackers control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC)

Can the log4j-1.2.17.jar from the \BrightStor SRM\Bin\HostConfig be deleted and how ?

 

Resolution

Installing the last patch of 12.7.871  Patch5 ,the log4j-1.2.17.jar is deleted and the CVE-2021-44228 / CVE-2021-45046 - Log4j  message is not displayed.