log 4j bug CVE-2021-44228- Urgently need to update log4j libraries for deployed jobs from talend 6.2.1

[YPMAL]

Hi,

We are using Talend 6.2.1 20160704_1411 version of talend running on our local servers.

As precautionary measure we need to update log4j library to avoid recent exploit named as CVE-2021-44228.

Can anyone tell me what measure can be taken to update log4j to

 Log4j 2.15.0 or apply the recommended mitigations immediately ?

[A1639565232]

Please note that there are some doubts raising on the reliability of the performed workaround : https://nvd.nist.gov/vuln/detail/CVE-2021-45046

Kindly advise.

[paula11]

@DSM_Daimler : You are right! Setenv.sh or .bat is irrelevant if wrapper used.

But in actual catalina...log you can see if the parameter was loaded at TAC startup 😉

[paula11]

Good hint @Reinier Battenberg​ ! I think other Talend-services may be are affected in the same way (Talend-Nexus, Talend-Logserver (logstash) ...)

Sad that Talend does not give more hints here...

[A1639565232]

Please note that there are some doubts raising on the reliability of the performed workaround : https://nvd.nist.gov/vuln/detail/CVE-2021-45046

Kindly advise.

[stucas]

/bump

https://nvd.nist.gov/vuln/detail/CVE-2021-45046 has stated:

Note that previous mitigations involving configuration such as to set the system property `log4j2.noFormatMsgLookup` to `true` do NOT mitigate this specific vulnerability. 

I just received an email from Talend support saying to implement this fix; which contradicts the above?

[MPT]

I understood NIST publication so that implementing the fix for log4jshell would mitigate the remote execution vulnerability but it does not prevent the attacker from exploiting JDNI so that they could still launch a distributed denial-of-service attack.

[stucas]

So that means the suggestion only mitigates part of the issue? I guess it's less of an issue if you have DDOS prevention at your WAN/Firewall before something gets in - but it's still a hole that is unacceptable to my security team.

[reinierD]

There is a full page with workarounds and patch dates here: ​https://www.talend.com/security/incident-response/

Some workarounds are different from previous answers in this thread!​

[Anonymous]

Hello All,

For information on how the Log4j2 vulnerability can be mitigated, please look here....

https://www.talend.com/security/incident-response/

Don't hesitate to post your issue here.

Best regards

Sabrina

[MPT]

Thanks. The screenshots on that page won't open as large images, are they supposed to?