Skip to main content
commvault.com commvault.com
Solved

server scanned hot for log4j after upgrade

W
Bit
Forum|alt.badge.img+1

I upgraded my CommServ to 11_20_85 and I read that this would remediate the log4j vulnerability. So I had the IA folks rescan the server and it came back hot and this is the path they sited. E:\ProgramFiles\Commvault\ContentStore\CVCIEngine\CvPreviewHome\webapps\CvContentPreviewGenApp\WEB-INF\lib\log4j-1.2.17.jar - they are advising to upgrade to a version of Apache Log4j

Best answer by Aplynx

Please take a look at this thread:

https://community.commvault.com/technical-blogs-and-articles-39/log4j-vulnerability-cve-2021-44228-1994

CVE-2021-4104: The Commvault software does not use the JMSAppender module and, therefore, the vulnerability about log4j 1.x versions does not affect any Commvault products.

View original
    Did this answer your question?

    4 replies

    Aplynx
    Vaulter
    Forum|alt.badge.img+13
    • AplynxVaulter
    • Vaulter
    • 291 replies
    • Answer
    • January 7, 2022

    Please take a look at this thread:

    https://community.commvault.com/technical-blogs-and-articles-39/log4j-vulnerability-cve-2021-44228-1994

    CVE-2021-4104: The Commvault software does not use the JMSAppender module and, therefore, the vulnerability about log4j 1.x versions does not affect any Commvault products.

    Liam
    MichaelCapon
    YYZ
    2 people like this
    • MichaelCapon
      MichaelCapon
    • YYZ
      YYZ
    W
    Bit
    Forum|alt.badge.img+1

    Thanks, I’ll relay this to our IA folks

    W
    Bit
    Forum|alt.badge.img+1

    Out of curiosity can this jar file be deleted.

    Mike Struening
    Vaulter
    Forum|alt.badge.img+23

    @Will Patrick , I wouldn't delete anything.  We likely use it for valid purposes, just not the vulnerable aspect/portion.

    https://www.linkedin.com/in/michael-struening

    Reply


    Most helpful members this week

    Terms & ConditionsCookie settings

    Cookie policy

    We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

     
    Cookie settings