CVE-2021-44228 log4j Vulnerability

Posted on December 10, 2021 at 6:11pm
JasperReports® Server
ashin's picture
ashin
67
Joined: Dec 10 2021 - 5:58pm
Last seen: 1 year 3 months ago

Yes, it seems but there is no clear procedure to upgrade the log4j version.

mohanreddy4 - 1 year 3 months ago

 (https://www.tibco.com/services/support/public-notices > https://www.tibco.com/support/notices/2021/12/apache-log4j-vulnerability-update)

Hot Fixes available 3/4 down the page.

djohnson53 - 1 year 3 months ago

Also: https://community.jaspersoft.com/wiki/apache-log4j-vulnerability-update-jaspersoft-products

djohnson53 - 1 year 3 months ago
show 1 more...

Another important link: https://support.tibco.com/s/article/TIBCO-Jaspersoft-Mitigation-for-CVE-2021-44228-Log4Shell

djohnson53 - 1 year 3 months ago
add comment

8 Answers:

Posted on December 13, 2021 at 6:09am

I was reading about it and we can mitigate as described at https://logging.apache.org/log4j/2.x/security.html

I suggest exporting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS setting to true at /etc/profile where it will be applied to all your users.

henrique.cezar's picture
henrique.cezar
80
Joined: Nov 18 2020 - 2:39pm
Last seen: 1 year 3 months ago
Posted on December 13, 2021 at 7:30am

JRS 7.9.0 Build 20210909_1344

Uses log4j 2.13.3 (see jar in WEB-INF/lib/log4j-core-2.13.3.jar)
Confirmed vulnerable signature with https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector

Recommended steps:
1) Define -Dlog4j2.formatMsgNoLookups=true in your JVM

OR

2) Replace the log4j 2.13.3 jars with 2.15 which is patched

I do not work for JasperSoft - YMMV

mrwizard's picture
mrwizard
127
Joined: Apr 28 2008 - 10:13am
Last seen: 1 year 3 months ago
Posted on December 13, 2021 at 8:17am

Hi there,
  I'm trying to do some tests on my environment, with a Jasper Report Server 7.5 already installed (Tomcat+Postgres+log4j 2.12.1), trying to upgrade log4j libraries.
The vulnerability seems to be placed in "log4j-core-2.12.1.jar", specifically in JndiLookup.class contained in the jar.
In my case I'm currently testing a simple replacement of jar files with the 2.15.0 fixed version (which has been declared be safe as of now - Dec 13th).

These are my changes:

log4j-core-2.12.1.jar ->       log4j-core-2.15.0.jar
log4j-api-2.12.1.jar ->        log4j-api-2.15.0.jar
log4j-1.2-api-2.12.1.jar ->    log4j-1.2-api-2.15.0.jar
log4j-slf4j-impl-2.12.1.jar -> log4j-slf4j-impl-2.15.0.jar
log4j-jcl-2.12.1.jar ->        log4j-jcl-2.15.0.jar
log4j-jul-2.12.1.jar ->        log4j-jul-2.15.0.jar
log4j-web-2.12.1.jar ->        log4j-web-2.15.0.jar

The change requires a Tomcat service stop and start to load the new library version.
In any case this is a self-made/not certified solution and - I'm pretty sure that a redeploy from Tomcat can override the changes.
Use all this stuff at your own risk - I do not work for JasperSoft

enrico.tafuro_1's picture
enrico.tafuro_1
86
Joined: Feb 11 2020 - 6:23am
Last seen: 1 week 4 days ago
Posted on December 13, 2021 at 12:37pm

 I have worked on a solution on a few servers runnings jasper server on version 7.5.0.

Basically i added  -Dlog4j2.formatMsgNoLookups=true to setEnv file on the apache-tomcat folder.

 

Furthermore, i set the env LOG4J_FORMAT_MSG_NO_LOOKUPS as the first awnser says.

Good luck.

vicenzo's picture
vicenzo
150
Joined: Sep 8 2020 - 10:53am
Last seen: 8 months 1 day ago
Posted on December 14, 2021 at 1:24pm

I've posted another question just to call this out directly (again) - 4 days of TIBCO working on resolutions, without so much as a mention of Jasper - not for community or enterprise. 

darth_fader's picture
darth_fader
3719
Joined: Mar 7 2010 - 9:45pm
Last seen: 1 week 3 days ago
Posted on December 15, 2021 at 5:07am

Now, there is CVE-2021-45046 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046)

gustavofarias's picture
gustavofarias
1755
Joined: May 22 2012 - 7:10am
Last seen: 3 days 16 hours ago
Posted on December 15, 2021 at 11:16am

darth_fader

You didn't look far enough down the page (https://www.tibco.com/services/support/public-notices > https://www.tibco.com/support/notices/2021/12/apache-log4j-vulnerability-update)

djohnson53's picture
djohnson53
162774
Joined: May 25 2012 - 11:10am
Last seen: 1 year 1 month ago
Posted on December 15, 2021 at 11:40am

And  on the support portal:

Which eventually takes you to https://www.tibco.com/support/notices/2021/12/apache-log4j-vulnerability-update

 

djohnson53's picture
djohnson53
162774
Joined: May 25 2012 - 11:10am
Last seen: 1 year 1 month ago

@djohnson53 in the last page you linked to, the Jasper Server link points to an empty page.

Do you know what is the plan for updating the vulnerable installers provided on community.jaspersoft.com and on Sourceforge?

We are using the Docker image and Helm chart of Bitnami and there will be no fix to that until patched installers are available.

dupont.sebastien - 1 year 2 months ago

all the links work

djohnson53 - 1 year 2 months ago

They won't update previous versions of the installers on the community editions on source forge.  The fixes will be included in the next release.  v8.0 is out now. It will have all the security fixes. New issues will be addressed in future releases of the community editions.

The previous versions available there are for migration purposes only.  If you have paid support, you may have other options thru them.

djohnson53 - 1 year 2 months ago
show 1 more...

Thank you for the answer

The linked pages were not properly shown because of my adblocker blocking coveo.com

dupont.sebastien - 1 year 2 months ago
add comment
Feedback