Skip to main content
commvault.com commvault.com
Solved

server scanned hot for log4j after upgrade

W
Bit
Forum|alt.badge.img+1

I upgraded my CommServ to 11_20_85 and I read that this would remediate the log4j vulnerability. So I had the IA folks rescan the server and it came back hot and this is the path they sited. E:\ProgramFiles\Commvault\ContentStore\CVCIEngine\CvPreviewHome\webapps\CvContentPreviewGenApp\WEB-INF\lib\log4j-1.2.17.jar - they are advising to upgrade to a version of Apache Log4j

Best answer by Aplynx

Please take a look at this thread:

https://community.commvault.com/technical-blogs-and-articles-39/log4j-vulnerability-cve-2021-44228-1994

CVE-2021-4104: The Commvault software does not use the JMSAppender module and, therefore, the vulnerability about log4j 1.x versions does not affect any Commvault products.

View original
    Did this answer your question?

    Aplynx
    Vaulter
    Forum|alt.badge.img+13
    • AplynxVaulter
    • Vaulter
    • January 7, 2022

    Please take a look at this thread:

    https://community.commvault.com/technical-blogs-and-articles-39/log4j-vulnerability-cve-2021-44228-1994

    CVE-2021-4104: The Commvault software does not use the JMSAppender module and, therefore, the vulnerability about log4j 1.x versions does not affect any Commvault products.

    Liam
    MichaelCapon
    YYZ
    2 people like this
    • MichaelCapon
      MichaelCapon
    • YYZ
      YYZ
    W
    Bit
    Forum|alt.badge.img+1

    Thanks, I’ll relay this to our IA folks

    W
    Bit
    Forum|alt.badge.img+1

    Out of curiosity can this jar file be deleted.

    Mike Struening
    Vaulter
    Forum|alt.badge.img+23

    @Will Patrick , I wouldn't delete anything.  We likely use it for valid purposes, just not the vulnerable aspect/portion.

    https://www.linkedin.com/in/michael-struening

    Reply


    Most helpful members this week

    Terms & ConditionsCookie settings

    Cookie policy

    We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

     
    Cookie settings