commvault.com commvault.com

Log4j Vulnerability - Please Post All Questions Here

Show first post

344 replies

J
Rank

We are currently running 11.20.82. We have around 120 SQL agents that are currently vulnerable. Would you be able to confirm if we can push out the fix to these clients as it would save us hours of additional work.

N
Rank
Badge +1

Hi @nizmoz 

Your screenshot is highlighting affected version 1.2.17 and CVE-2021-4104.

Please review the notes above in the original post which explain:


CVE-2021-4104: The Commvault software does not use the JMSAppender module and, therefore, the vulnerability about log4j 1.x versions does not affect any Commvault products.

and

Q:  I've noticed older 1.x versions of log4j being used in the platform.  Are these vulnerable? 

A:   We have some older instances in the installed component structure related to the older generation Log4J 1.x files which are not part of the current CVE Log4J 2.x vulnerability. We are doing further investigation on those conditions to determine a course of action.  

Thanks,

Stuart

The files still exist, and our security team and management want them removed.  So can these safely be deleted if they are not being used?

S
Rank
Userlevel 7
Badge +15

Hi @James_Goodison 

Yes, you’re already above the minimum versions for 11.20, so (as described in the original post at the top) all you will need to do is run a Copy Software job for the hotfixes for 11.20 into the software cache and install updates on clients.

Thanks,

Stuart

Customer Support
S
Rank
Userlevel 7
Badge +15

Hi @LucM - BergerPeatMoss 

Not all hotfixes are applicable to all clients, so if you manually install a hotfix on a client that doesn’t contain any affected packages, you may see the information alert “None of the updates are applicable for the packages installed on the machine” similar to this:
 

All that means is the affected packages were not found on that client and the hotfix was not needed for that client.

Please proceed with installation of the remaining hotfixes for your version.

Thanks,

Stuart

 

Customer Support
Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@bc1410 , dev is working on this now, though I can’t share a release date just yet.

Once it’s available, I’ll reply here and update the main post at the top.

https://www.linkedin.com/in/michael-struening
S
Rank
Userlevel 7
Badge +15

Hi @Paul Hutchings 

The only agents identified as affected are the ones listed, and the hotfixes provided are only applicable for those agents.

These hotfixes released to address this issue will be provided in the next Maintenance Release, scheduled for release in early January. So you can always catch up and apply the latest MR in January to ensure your environment is ultimately protected then.

Thanks,

Stuart

Customer Support
Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Hi @Libor 

Support for V10 ended in December 2017, so no new hotfixes will be provided for V10 beyond SP15.

Log4j versions affected by this vulnerability are 2.0-2.14. Apache have provided a fix for this vulnerability in 2.15.

Thanks,

Stuart

Understand but i am not asking for hot fix or so. I am asking if V10 SP15 is impacted by

CVE-2021-44228.

Also i would like to know which log4j version is used in  V10 SP15 ?

I would like to know this so i can be aware of possible risk and maybe to apply some workarounds because our environment does not allow update to higher version ATM.

Thank You!

@Libor , older versions are not impacted.  I don’t know the specific versions we had in use on v10 SP15, though they are not affected.

https://www.linkedin.com/in/michael-struening
B
Rank
Userlevel 4
Badge +14

Hi @Bloopa , @Mohit Srivastava 

The minimum MR level needs to be deployed to the Commserve to bring the Commserve up to that level, the the log4j hotfixes deployed to affected clients.

If the hotfix is deployed to all clients or some client that isn’t exposed, the hotfix will simply execute, determine no updates apply and exit. So there’s no impact if this fix is deployed to unaffected clients.

In fact this is true of all hotfixes, if they don’t apply to the targeted client, the hotfix installer will tell you no updates apply to this system and then exit.

The Commserve and Media Agents aren’t affected by log4j as they do not have those packages present in their installations. Commserve simply needs to be updated to the minimum level to facilitate push updates to all other clients.

Thanks,

Stuart

Thanks for all these important informations !

Steven Robinson
Rank
Userlevel 3
Badge +5

Thanks so much Mike.
Just a question as the 3 servers that were flagged are still showing as being an issue. SP11_25_14 has been installed last night.

 

 

 

Hi Mauro, can you confirm you are using the latest version of the Log4J Affected Servers report (1.1.2.3)? If not, please download and try the latest version to see if it gives different results.

“I did then what I knew how to do. Now that I know better, I do better.” ― Maya Angelou
R
Rank
Badge

As per the article - Log4j – Apache Log4j Security Vulnerabilities, Log4j 1.x has reached end of life and is no longer supported. Vulnerabilities reported after August 2015 against Log4j 1.x were not checked and will not be fixed. Users should upgrade to Log4j 2 to obtain security fixes.

So kindly suggest if there is any use of log4j.1.x in Commvault as we can see multiple files in our installation directories. Please suggest how we can proceed on this.

J
Rank
Userlevel 5
Badge +11

hi @KGreer 

 

Did you unzip the individual patches?

 

You should be able to just unzip the main download then point copy to cache to this folder (containing all the zipped individual patches) and let it copy everything.

 

Then it makes it easy to deploy to the respective clients that needs it which could be on different platforms etc.

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@CVLT , don’t remove anything just yet.  The Next Maintenance Release (1st of February) will do that for you, safely.

https://www.linkedin.com/in/michael-struening
J
Rank
Userlevel 5
Badge +11

hi @DanC 

 

Looks like defender is incorrectly identifying Log4j 1.x files as part of cve-2021-44228. Lof4j 1.x is NOT impacted by this CVE.

 

Commvault does however understand that Log4j 1.x is quite old and may have other vulnerabilities so are currently putting together a plan to address this. Please note that Log4j 1.x does NOT have the most critical 0-day vulnerabilities in cve-2021-44228 like Log4j 2.x does. 

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Absolutely recommended to wait until the Maintenance Release on Feb 1.

https://www.linkedin.com/in/michael-struening
Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Hi @jmiamaral !

Quick answers below (the best detail is all in the original post that we keep updated):

  1. 11.20.85 is what you want.  Note that we are releasing another MR on Feb 1st which will clear out the 1.x versions as well
  2. The Commserve and any clients that show up in the report that lists out vulnerable clients (all documented in the 1st post in this thread)

Let me know if anything is still unclear :nerd:

https://www.linkedin.com/in/michael-struening
S
Rank
Userlevel 7
Badge +15

Hi @EPick 

Yes, it’s a 2 stage task:

  1. Update to the minimum level MR for your version.
  2. Install all the hotfixes provided for affected clients

If you deploy hotfixes to clients that aren’t affected, there’s no issues there, the installer will simply exit with a message similar to “there are no updates applicable for this system” as not all clients/agents are affected by log4l vulnerability.

Likewise, the hotfixes target separate packages with different hotfixes for Cloud Apps, Oracle and SQL, so not all hotfixes apply to all clients.

And  yes, you can run a copy software job to import the hotfixes to the software cache and deploy centrally from the Commserve.

Thanks,

Stuart

Customer Support
Steven Robinson
Rank
Userlevel 3
Badge +5

Chomping at the bit here, are we still set for the new MR today?

Depending on where you are in the world, it may be 2nd February when it hits the store.  As Jordan said, it should already be available in the GUI if you want to download it from within the CommCell.

“I did then what I knew how to do. Now that I know better, I do better.” ― Maya Angelou
M
Rank
Badge

hello,

i did all the recemented steps the you wrote

  1. Unzip the contents of the download
  2. Run Copy To Cache to add the new updates to your software cache
  3. Push out updates to the clients

How do I make sure the update has worked and I am no longer vulnerable?
Is there a way to identify it? Does the agent version change?
Just to note, we only have SQL agents

     

S
Rank
Userlevel 3
Badge +8

Hi All,

 

 

Any updates on Log4J 1.X version Vulnerability hot-fix /Maintenance release ?

Like a done bun.

Seems to work like a charm.

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Hi All,

 

I can see 11.26.8 MR has been released on 1FEB does this release will clear all Log4J1.x  ? 

Yup!!

https://www.linkedin.com/in/michael-struening
K
Rank
Badge

Hi @James_Goodison 

You will need to apply both the minimum or higher MR level for your version plus all the hotfixes provided.

The hotfixes provided cover all affected agents for different client OSes, you need to import all the hotfixes to the cache and on installation, on the required hotfixes are provided.

If you are having trouble importing the hotfixes to the cache, please try running a copy software job on the folder containing the still zipped Log4J-Updates.zip.

Thanks,

Stuart

Hi Stuart, 
Apologies, please can you clarify your statement? 

I’ve installed the 11.20.82 MR, do I now need to install every hotfix in the folder to every agent? (Hotfix4562_Win32 and X64 AND Hotfix4563_Win32 and X64?)

Can these be installed remotely via copy software job etc or do I need to install these manually on each agent? Agents only use Windows SQL Server. 

 

Thanks in advance. 

 

OK, this was the critical step that wasn’t detailed enough in the directions.

The Copy Files job didn’t see the .zip file.

I unzipped the Log4J-Updates.zip file and pointed the Copy Files to the resulting folder.

This seemed to work.

I was originally pointing at the unzipped folders/files that were extracted from running the specific x64 hotfix exe.

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@EN-US , we should be ok here:

Current Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

The recent Maintenance release upgraded all the 1.2 to 2.17.x

https://www.linkedin.com/in/michael-struening
Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@DanC , the public release you want is 11.24.34.  Will remove all v1 copies and upgrade them to 2.17.x.

https://www.linkedin.com/in/michael-struening
Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

@KGreer  thanks for that detail.  I updated the original post instructions mentioning to point to the folder created by the unzip!

https://www.linkedin.com/in/michael-struening
D
Rank
Userlevel 5
Badge +8

I don't know if this falls into this category or if this is something else completely different, one of our departments is saying our servers we use for Commvault are using log4shell v1.2x. They need to update it to v2.16.0. Is this related to this topic? Does Commvault support this version of log4shell?

1.x is not affected by this vulnerability, our updates are specifically targeting the CVSS 10 vulnerability and therefore updates the affected 2.x versions.  We are however investigating upgrade paths for 1.x nonetheless … this will be addressed separately.  In cases like HyperScale 1.x log4j are still maintained and supported by RedHat.

Thank you, but the first part of the question i asked was overlooked.  is this log4shell a third party app which the server has installed prior to Commvault software, or is this something that Commvault installs, That's where the confusion comes into play for me, because it comes down to weather or not the department that brought this up is asking us for permissions to update it, or if this is something to do with commvault software which my team needs to handle?

Log4j is a java based open sourced logging utility.  It is used in millions of applications across the world.  It is possible another application is running on the system that could be using this.

But it is used throughout  the Commvault platform, specifically affected versions are bundled with SQL, Oracle, and Cloud App installations.  It is only active if you have DB archiving, masking, or table level restore enabled...so its a slim edge case, yet one you want to address.  You need to focus on applying the hotfixes to those apps.  Hope that helps.

 

Reply


Terms & ConditionsCookie settings