topic Re: log4j vulnerability in Installing and Upgrading

log4j vulnerability

SZollikofer — Fri, 15 Nov 2024 23:25:22 GMT

Hi,

is Talend BD 6.4.1 affected at all by the log4j vulnerability problem?

The Talend installation and workspace directories only contain older versions log4j-1.2.15.jar and log4j-1.2.16.jar.

The log4j problem affects only log4j versions higher than 2.0.

So am I correct that Talend BD 6.4.1 is not affected?

Re: log4j vulnerability

JSD03 — Mon, 13 Dec 2021 15:47:53 GMT

Hello,

Same question for Talend ESB 7.3.1 regarding this official announcement : https://logging.apache.org/log4j/2.x/security.html

And if yes what is the procedure to upgrade the version (not talend just log4j)

Re: log4j vulnerability

MikeBender27 — Mon, 13 Dec 2021 20:58:50 GMT

My security team is asking the same questions. We are running Talend Cloud Big Data 7.3.1 with Talend Studio 7.3.1 and I would like to understand our exposure to this vulnerability.

Re: log4j vulnerability

lfr — Tue, 14 Dec 2021 12:29:17 GMT

We are preparing migration to 7.3.1 and we are waiting also news and recommandation from Talend

Re: log4j vulnerability

Anonymous — Wed, 15 Dec 2021 21:50:15 GMT

Hi all, I'd like to draw your attention to this page on the vulnerability....

https://www.talend.com/security/incident-response/

Re: log4j vulnerability

JSD03 — Thu, 16 Dec 2021 15:37:53 GMT

Yes good: we have applied this fix on our system but since a new log4j vulnerability has been published today : https://nvd.nist.gov/vuln/detail/CVE-2021-45046. Do you have a new workaround ?

Re: log4j vulnerability

Anonymous — Thu, 16 Dec 2021 16:07:17 GMT

Just to be clear, the document linked to above does not list fixes, it lists ways to mitigate for this issue until patches are ready. I have spoken to our Support team and have been informed that the incident-response page is being updated as we speak.

Re: log4j vulnerability

JSD03 — Thu, 16 Dec 2021 16:23:12 GMT

OK thanks for the clarification

Re: log4j vulnerability

seaferring — Mon, 07 Feb 2022 15:02:43 GMT

Mitigation is NOT remediation. A company like Talend should know this. I suspect they do and just do not care.

Re: log4j vulnerability

Anonymous — Mon, 07 Feb 2022 15:23:46 GMT

Hi @Malcolm O'Callaghan,

If you take a look at the page I pointed to (https://www.talend.com/security/incident-response/) you will see that patches or upgrades have been released for all of our subscription products. The mitigation steps were added to allow people to make their environments as safe as possible while the R&D work was taking place on the patches. These were released as soon as possible.

Some of the many benefits of using the subscription product are that it comes with support, upgrades and patches. The Open Studio product does not. Due to this, there is no "patch" implementation functionality built-in to it. To upgrade, you need to take a new version. When the new version is released, it will contain all of the fixes to these Apache Log4j issues. If you would like to receive the benefit of patches, upgrades and support, I can arrange for one of our sales team to contact you. Please let me know if this is a route that you'd like to take.

Regards

Richard

Re: log4j vulnerability

dtxstg — Thu, 10 Feb 2022 11:55:43 GMT

Hello,

we are waiting for a patch fixing this issue (TOS version 8.0.1). The last update of the article https://www.talend.com/security/incident-response/ was three weeks ago. The only information regarding a patch for TOS is "Remediation for Talend Open Source is not in scope". Are there any information when a patch for TOS approximately is beeing released?

Re: log4j vulnerability

Anonymous — Thu, 10 Feb 2022 15:30:40 GMT

I'm afraid a patch for TOS will not be released. It will be fixed in the next version. There are certain mitigation steps you can follow in the article you linked to.

Re: log4j vulnerability

dtxstg — Thu, 10 Feb 2022 16:35:12 GMT

@Richard Hall Thank you for your fast reply. Is it foreseeable when the next Version of TOS is beeing released?

Re: log4j vulnerability

Anonymous — Thu, 10 Feb 2022 18:35:57 GMT

Hi @Marc Veitinger,,

I am not currently aware of the schedule for the next release, but I have put a couple of questions out to our R&D team. When I get a response, I will update.

I should point out that they may not have this set in stone as yet since we have only just released v8. If that is the case, it may take a while before I can confirm a period.

Regards

Richard