Steps to remove the Apache log4j.jar (log4j1.x.) from from Web Agent Option Pack (WAOP).
Article ID: 452541
Updated On:
Products
Issue/Introduction
The following location in SiteMinder Option Pack for Web Agent contain 'log4j.jar' version " 1.x. "
Location: XXXX\CA\webagent\win64\affwebservices\WEB-INF\lib\log4j.jar
Environment
Product Name=SiteMinder Option Pack for Web Agent (Web Agent Option Pack (WAOP)).
FullVersion=12.52.111.2820
Cause
CVE-2020-9488 - Apache log4j (log4j1.x.) Vulnerability has been identified.
CVE-2020-9488 Description:
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
Resolution
------ WAOP does not use log4j in its functionality, so administrator can remove it and mitigate from log4j1.x.
Please follow the below instructions on how to remove log4j from the WAOP component.
Please test this in a lower TEST environment and check all the possible use cases before testing in PROD.
Also, please back up the existing files before making changes.
- Steps to remove the log4j.jar from Web Agent Option Pack (WAOP).
------ OPTION 1: In case of existing Deployment of affwebservices.
Stop the running affwebservices (WAOP) application from its deployment.
Navigate to affwebservices/WEB-INF/lib
Find log4j.jar and remove it.
Start the affwebservices application.
Make sure http://fqhn:port_number/affwebservices/assertionretriever is working fine.
For example:
http://myhost.ca.com:81/affwebservices/assertionretriever
If FWS/affwebservices is operating correctly, the following message is displayed:
Assertion Retrieval Service has been successfully initialized.
The requested servlet accepts only HTTP POST requests.
------ OPTION 2: In the case of new deployments of affwebservices.
Stop the running affwebservices (WAOP) application from its deployment.
Un-Deploy the affwebservices application from the deployment.
Navigate to the affwebservices folder that came with the installation of WAOP.
Go to affwebservices/WEB-INF/lib
Find log4j.jar and remove it.
Re-Create the affwebservices.war file as per WAOP documentation.
Deploy the affwebservices application to the location from which it was undeployed in step 2.
Start the affwebservices application according to the deployed server.
Make sure http://fqhn:port_number/affwebservices/assertionretriever is working fine
For example:
http://myhost.ca.com:81/affwebservices/assertionretriever
If FWS/affwebservices is operating correctly, the following message is displayed:
Assertion Retrieval Service has been successfully initialized.
The requested servlet accepts only HTTP POST requests.
Feedback
