commvault.com commvault.com

Log4j Vulnerability - Please Post All Questions Here

Show first post

344 replies

A
Rank
Badge +3

Our Commserve and Media agent were running on 11.20.77. I have copied hotfix to cache and I was able to push udpates to Media agents and clients and successfully updated them. However, update job just gets stuck and doesn’t install on Commserve. 

 

Updateinfo log attached.

 

I have also tried to run v11SP20_Available_HotFix4562_WinX64 manually. This execution also ends saying waiting for dedup process to exit and all commvault services go to disabled state. I have to set them all to automatic and restart manually. 

1 Attachment
J
Rank
Userlevel 5
Badge +11

Hi @ameersyed 

 

Please raise a support incident to specifically review your CS and why the updates are not installing.

 

Something appears to be stuck based on your log snippet.

 

Thank you

K
Rank
Badge

Hello there,

 

I see that Maintenance Release 82 is available. So my question is if installing Maintenance Release 82 for version 11.20 would suffice this vulnerability ?

 

Thank you

S
Rank
Userlevel 7
Badge +15

Hi @Krishan Bhatt 

There are 2 steps to apply this fix:

  1. Bring your environment up to the minimum MR level for your version
  2. Download and install the appropriate Log4j fixes for your version

As you are running 11.20.82, that’s step 1 achieved, but you still need to download and apply the log4j fixes for 11.20.

Thanks,

Stuart

Customer Support
J
Rank

Hi,

Please would you be able to clear up a couple of questions for me please?

  1. We are running 11.20.82 and when clicking on the link provided and downloading the 11.20 Log4J Fix files provided, within that zipped folder it lists different files for different operating systems. Can you confirm which we should be using as there appears to be two different .exe files for two separate Hotfixes (HotFix4562 and HotFix4563)
    1. In regards to installing this .exe file remotely via the CommCell console it says in the original post of this thread that to install the “Hotfix” we should be able to add it to the cache and remotely update each agent. Can you clarify which you are referring to at this point? Is this to install the “Maintenance Release” or the “Log4JFix”. If this is for the Log4JFix then please could you confirm that this does work as we have had issues attempting to add the file to the cache.
S
Rank
Userlevel 7
Badge +15

Hi @James_Goodison 

You will need to apply both the minimum or higher MR level for your version plus all the hotfixes provided.

The hotfixes provided cover all affected agents for different client OSes, you need to import all the hotfixes to the cache and on installation, on the required hotfixes are provided.

If you are having trouble importing the hotfixes to the cache, please try running a copy software job on the folder containing the still zipped Log4J-Updates.zip.

Thanks,

Stuart

Customer Support
E
Rank
Badge

Hi @James_Goodison 

You will need to apply both the minimum or higher MR level for your version plus all the hotfixes provided.

The hotfixes provided cover all affected agents for different client OSes, you need to import all the hotfixes to the cache and on installation, on the required hotfixes are provided.

If you are having trouble importing the hotfixes to the cache, please try running a copy software job on the folder containing the still zipped Log4J-Updates.zip.

Thanks,

Stuart

Hi Stuart, 
Apologies, please can you clarify your statement? 

I’ve installed the 11.20.82 MR, do I now need to install every hotfix in the folder to every agent? (Hotfix4562_Win32 and X64 AND Hotfix4563_Win32 and X64?)

Can these be installed remotely via copy software job etc or do I need to install these manually on each agent? Agents only use Windows SQL Server. 

 

Thanks in advance. 

J
Rank

Hi @James_Goodison 

You will need to apply both the minimum or higher MR level for your version plus all the hotfixes provided.

The hotfixes provided cover all affected agents for different client OSes, you need to import all the hotfixes to the cache and on installation, on the required hotfixes are provided.

If you are having trouble importing the hotfixes to the cache, please try running a copy software job on the folder containing the still zipped Log4J-Updates.zip.

Thanks,

Stuart

In our environment we are only managing x64 Windows Operating System servers running SQL Server. Are you saying that in order to plug this vulnerability we need to install the following 4 updates from the Log4J-Updates.zip to each server?

v11SP20_Available_HotFix4562_Win32.exe
v11SP20_Available_HotFix4562_WinX64.exe
v11SP20_Available_HotFix4563_Win32.exe
v11SP20_Available_HotFix4563_WinX64.exe

Also are you saying that we can add these 4 updates to the CommVault software Cache and remotely push these out?

K
Rank
Badge

Hi @Krishan Bhatt 

There are 2 steps to apply this fix:

  1. Bring your environment up to the minimum MR level for your version
  2. Download and install the appropriate Log4j fixes for your version

As you are running 11.20.82, that’s step 1 achieved, but you still need to download and apply the log4j fixes for 11.20.

Thanks,

Stuart

I have installed the hotfix for 11.20.77 however the CS and MA servers are showing only SP20-HotFix-4562.

 

Is it OK that way or the servers are suppose to show all hotfixes viz HotFix4561 HotFix4562 HotFix4563

 

Thank you

S
Rank
Userlevel 7
Badge +15

Hi @EPick 

Yes, it’s a 2 stage task:

  1. Update to the minimum level MR for your version.
  2. Install all the hotfixes provided for affected clients

If you deploy hotfixes to clients that aren’t affected, there’s no issues there, the installer will simply exit with a message similar to “there are no updates applicable for this system” as not all clients/agents are affected by log4l vulnerability.

Likewise, the hotfixes target separate packages with different hotfixes for Cloud Apps, Oracle and SQL, so not all hotfixes apply to all clients.

And  yes, you can run a copy software job to import the hotfixes to the software cache and deploy centrally from the Commserve.

Thanks,

Stuart

Customer Support
S
Rank
Userlevel 7
Badge +15

Hi @James_Goodison 

You only need to install the hotfixes for the versions you have installed, if you only have x64 bit clients, you will only need to deploy the 64 bit hotfixes.

When you import these hotfixes into the software cache and then run an install updates job, the Commserve and software cache is intelligent to only provide hotfixes for the client installation version and the packages installed on that client.

 

@Krishan Bhatt 

Commserve and MA are not affected by the log4j vulnerability, but they may have packages installed for corresponding hotfixes, e.g. FileSystemCore agent will be found on every client in the Commcell.

You will only see hotfixes shown in client properties if that client has a package installed with a corresponding hotfix.

For example, where we are providing a hotfix for Oracle agent, if you attempt to install this on the Commserve, it will tell you no updates applicable for this client and likewise the Oracle hotfix will not be shown on Commserve client properties.

 

Thanks,

Stuart

Customer Support
J
Rank

Hi @Stuart Painter , 

Is there a way to see in the CommServe gui which hotfixes are already applied to Clients? Also I have manually installed the 2 x64 patches to one of our test servers and now it states the agent is “ahead of cache” is this what you would expect?

 

M
Rank
Badge

hello,

i did all the recemented steps the you wrote

  1. Unzip the contents of the download
  2. Run Copy To Cache to add the new updates to your software cache
  3. Push out updates to the clients

How do I make sure the update has worked and I am no longer vulnerable?
Is there a way to identify it? Does the agent version change?
Just to note, we only have SQL agents

     

S
Rank
Userlevel 7
Badge +15

Hi @James_Goodison 

If you have manually installed MR or hotfixes manually on a client before importing to the cache, then yes, these clients would be classified as “ahead of cache”.

Importing MR and hotfixes into the cache will bring these into line.

You can check client properties in the Commcell console, the client lines as you have in your screenshot show the MR version, but won’t list specific hotfixes installed. Client properties for each client will show hotfixes installed and against which package they apply.

Thanks,

Stuart

Customer Support
M
Rank
Badge +1

We have successfully installed the Hotfix for our 11.20.77 environment. In the Java Console the applied hotfixes are shown as expected:

But when we perform a scan for vulnerable log4j files, by using the command line utility form lunasec (https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/), the affected file gets still determined under the following path: "C:\Program Files\Commvault\ContentStore\Updates\SP20-HotFix-4560\GxHomeDir\Base\DbJars\DbArchiveEngine.jar"

Is that an expected situation?

Regards,
Matthias

J
Rank

@Stuart Painter 

I have just tried to add the first hotfix to the cache and when doing it we get the following error message.

Please can you advise?

O
Rank
Badge +1

@Dave S  All of these are covered by the hotfix:

CVE-2021-44228

CVE-2020-9488

CVE-2019-3826

CVE-2019-17531

CVE-2017-5645

I’ll look into your CVE.

Was the latest CVE CVE - CVE-2021-45046 looked into as to whether this was covered under the hotfix ?

S
Rank
Userlevel 7
Badge +15

@James_Goodison

[Edited for clarity]

You have selected a folder a few levels too deep for the hotfix to get detected.

You need to select the folder containing the extracted hotfixes.

The Copy Software job will handle the import of the separate hotfixes.

Thanks,

Stuart

Customer Support
J
Rank

@Stuart Painter 
 

It doesnt seem to matter which level I do it at it fails with the same error. It also doesn’t allow to import zip files.

Can you provide a screen shot of yourself importing successfully?

L
Rank
Badge +1

Hi,
we have a question, we have applied the last fix for LOG4J but we saw that Commvault use version 2.15
 

but we can read on the web that hte Version 2.15 was most probably enough to protect us from attack but version 2.16 makes it certain !

do you know if Commvault will have rapidly a new fix for us with version 2.16 ?

K
Rank
Badge

Hi @James_Goodison 

You will need to apply both the minimum or higher MR level for your version plus all the hotfixes provided.

The hotfixes provided cover all affected agents for different client OSes, you need to import all the hotfixes to the cache and on installation, on the required hotfixes are provided.

If you are having trouble importing the hotfixes to the cache, please try running a copy software job on the folder containing the still zipped Log4J-Updates.zip.

Thanks,

Stuart

Hi Stuart, 
Apologies, please can you clarify your statement? 

I’ve installed the 11.20.82 MR, do I now need to install every hotfix in the folder to every agent? (Hotfix4562_Win32 and X64 AND Hotfix4563_Win32 and X64?)

Can these be installed remotely via copy software job etc or do I need to install these manually on each agent? Agents only use Windows SQL Server. 

 

Thanks in advance. 

 

OK, this was the critical step that wasn’t detailed enough in the directions.

The Copy Files job didn’t see the .zip file.

I unzipped the Log4J-Updates.zip file and pointed the Copy Files to the resulting folder.

This seemed to work.

I was originally pointing at the unzipped folders/files that were extracted from running the specific x64 hotfix exe.

L
Rank
Badge +1

Hi,

We have a question, we applied the last fix LOG4J but we saw that Commvault use the version 2.15

 

We can read on the web that the version 2.15 was probaly enough to protect us from attack but version 2.16 makes it certain !

 

Do you know if Commvault will have rapidly a new fix for us with version 2.16 ?

S
Rank
Userlevel 7
Badge +15

@m.rieder @Oriium 

Checking these queries internally, I’ll get back to you

Thanks,

Stuart

Customer Support
V
Rank
Badge

Apache made some recent changes at their end. is that been collaborated in the hotfix which CV is providing

D
Rank
Userlevel 3
Badge +13

Hello team,

Log4j 1.x has reached end of life and is no longer supported. Vulnerabilities reported after August 2015 against Log4j 1.x were not checked and will not be fixed. Users should upgrade to Log4j 2 to obtain security fixes.
https://logging.apache.org/log4j/2.x/security.html

does Commserve tomcat (Log4j1.x) comes with JMSAppender ?

https://bugzilla.redhat.com/show_bug.cgi?id=2031667

 

Reply


Terms & ConditionsCookie settings