log 4j bug CVE-2021-44228- Urgently need to update log4j libraries for deployed jobs from talend 6.2.1

[YPMAL]

Hi,

We are using Talend 6.2.1 20160704_1411 version of talend running on our local servers.

As precautionary measure we need to update log4j library to avoid recent exploit named as CVE-2021-44228.

Can anyone tell me what measure can be taken to update log4j to

 Log4j 2.15.0 or apply the recommended mitigations immediately ?

[jonlar]

Hi, this is also the case for Talend 7.2.1.

Found the exploit in the following modules

• Elasticsearch instance and logstash
• Syncope
• Talend Runtime Container -> (pax-logging-log4j2-1.10.1-TESB.jar)

Any follow-up from the Talend team would be greatly appreciated

After trying the mitigation solution, the runtime is still permiting a canarytoken from bein accessed.

Thanks

[Anonymous]

hello - is there any update to this thread?

[AKumar1639363095]

Hi All,

I am also very interested in a solution to this.

Has anybody tried to replace the log4j jar in the lib folder?

I can see all other major providers have sent a respective security bulletin, however, no such communication has been received from Talend.

Thanks

[Anonymous]

According to the message posted on the Talend Case Management Tool:

ALERT: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.

Our Security team is aware of the recently reported CVE-2021-44228 and is working towards a permanent fix.

Talend Cloud Applications are configured to block exploits against this threat and thus will not be affected by this CVE.

For any On Prem Talend applications such as Remote Engines, Tac, and Studio. Customers may add the following flag, "-Dlog4j2.formatMsgNoLookups=true" to the Tac, Studio and Remote Engine.

If you need assistance on how to set this flag, please contact technical support.

[Anonymous]

Hello,

Here exists a related support case: 00245507 and Our team has been made aware of the vulnerability at this time, and is currently in the process of identifying all modules in Talend affected and working on a fix for the issue at hand.

 In the meantime, for your Studio, TAC, and Jobserver, there is an interim solution that may help block those exploits. The following flag, "-Dlog4j2.formatMsgNoLookups=true" can be added to those modules that should disable the libraries in Log4j that are in the scope of the risk.

For the Studio, it can be added to the ini file at the bottom of the file; once added, save and estart the studio, and the JVM flag will be applied.

For your TAC, it would need to be added to either the " setenv.sh (https://setenv.sh/) ( https://setenv.sh (https://setenv.sh/) /) " script in the "<TAC Folder>/apache-tomcat/bin folder", as an additional parameter in the JAVA_OPS section.

In the Jobserver, that flag can be added to the service, which should apply for all jobs. More information can be found here:

https://community.talend.com/s/article/Set-a-JVM-property-for-all-the-Jobs-executed-by-a-JobServer-o...

Please review these items, try these steps out, and let us know if it is OK with you.

Best regards

Sabrina

[welshsteve]

Hi. Can I just confirm the ini file this needs to be added to is the main studio ini file e.g. ..\TalendStudio\Talend-Studio-win-x86_64.ini

Thanks

Steve

[reinierD]

How do you add the setting to a Remote Engine?

[welshsteve]

I have asked Talend Support the same thing, but am awaiting a reply. We use two on-prem remote engines, so need to know if I have to make changes.

[DSM_Daimler]

It depends on how you run the remote-engine. When using windows service running the software, add the JVM parameter in the <RemoteEngineSoftware)>etc/Talend*wrapper.conf into the JVM parameters section as an extra one, similar to the screenshot below. Your conf file may have a different name and/or more settings in it, depending on how you installed and configured the wrapper originally.