topic Re: Apache Log4j Vulenrability in Qlik Replicate

Apache Log4j Vulenrability

PICTConversionTeamDevs — Thu, 05 Sep 2024 15:32:23 GMT

we have found below two Vulnerability for file Attunity\Replicate\java\java_file_factory.jar
CVE-2019-17571
CVE-2022-23305

Back in 2021, we did fix the Apache Log4j vulnerability by upgrading it to the higher version with the following documents, but somehow the file Attunity\Replicate\java\java_file_factory.jar still reference to old log4j

PS D:\Attunity\Replicate\endpoint_srv\externals> ls log4j*

Directory: D:\Attunity\Replicate\endpoint_srv\externals

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/3/2020 11:09 AM 264060 log4j-api-2.11.1.jar
-a---- 6/3/2020 11:09 AM 1607947 log4j-core-2.11.1.jar-vulnerable
-a---- 12/17/2021 4:03 PM 1589223 log4j-core-nolookup-2.11.1.jar

We know QLIK does not support Replicate 6.6 and can't provide any fix. Does anyone know if there is any fix/workaround to update the log4j version in file Attunity\Replicate\java\java_file_factory.jar

we are planning to upgrade qlik replcate but that will take some time.

Re: Apache Log4j Vulenrability

Dana_Baldwin — Thu, 05 Sep 2024 18:22:27 GMT

Hi @PICTConversionTeamDevs

As you have mentioned, upgrading from version 6.6 is the best course of action to alleviate this vulnerability, but we do understand that an upgrade should be well planned and tested, especially when moving from an unsupported version as you will need to apply more than one upgrade.

Please refer to this knowledge article on how to update log4j without upgrading Replicate. Please test this thoroughly in a pre-production environment before attempting in production: CVE-2021-45105/CVE-2021-44832 - Update to log4j 2.... - Qlik Community - 1876190

As you plan your upgrade, you may find this information helpful:

Upgrade guide/best practices: Qlik Replicate Upgrade Best Practices - Qlik Community - 1729651

As noted in this link, please ensure your operating system, source/target endpoint versions are supported, and any needed updates to driver software are considered.

Please refer to the release notes for the version you will upgrade to regarding which versions need to be installed to get to your desired end version.

I hope this helps!

Dana

Re: Apache Log4j Vulenrability

PICTConversionTeamDevs — Thu, 05 Sep 2024 18:40:23 GMT

Thanks for the details. We followed similar documents around 2021 to upgrade the log4j from 1.2.17 to 2.* version.

Directory: D:\Attunity\Replicate\endpoint_srv\externals

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/3/2020 11:09 AM 264060 log4j-api-2.11.1.jar
-a---- 6/3/2020 11:09 AM 1607947 log4j-core-2.11.1.jar-vulnerable
-a---- 12/17/2021 4:03 PM 1589223 log4j-core-nolookup-2.11.1.jar

but somehow this file "Attunity\Replicate\java\java_file_factory.jar" is still referencing to log4j 1.2.17

Do you think upgrading the log4j from 2.11.1 to 2.17.1, as mentioned in this document will also update the log4j version in the file Attunity\Replicate\java\java_file_factory.jar??

Re: Apache Log4j Vulenrability

Dana_Baldwin — Thu, 05 Sep 2024 20:09:16 GMT

Hi @PICTConversionTeamDevs

It doesn't seem like it would, but we should check on this issue with our internal support team / R & D. We don't have a way to elevate issues from our forum to them, could you please open a support case for this?

Thanks,

Dana

Re: Apache Log4j Vulenrability

john_wang — Fri, 06 Sep 2024 01:24:43 GMT

Hello @PICTConversionTeamDevs ,

Besides @Dana_Baldwin comments, looks to me the two vulnerabilities do not apply to Qlik Replicate as Qlik Replicate do not use the SocketServer class and Apache Chainsaw. Let's get confirmation from CF/R&D.

Thanks,

John.

Re: Apache Log4j Vulenrability

PICTConversionTeamDevs — Fri, 06 Sep 2024 18:13:55 GMT

Thanks John,

Those two vulnerabilities are for Log4J 1.2.17, referenced in qlik path \Attunity\Replicate\java\java_file_factory.jar.

We may need to either update the version in that jar file or remove the reference.

I already have a QLIK case open regarding this issue.

00306526: Apache Log4j Vulenrability

Re: Apache Log4j Vulenrability

john_wang — Sun, 08 Sep 2024 11:00:27 GMT

Thank you @PICTConversionTeamDevs , our support will work on it.

Regards,

John.