Jan 9, 2022 11:58:56 PM
Qlik is providing these mitigation steps as a temporary measure. A patch will be provided and linked here; customers are advised to move to the patch as soon as it is available.
cp ~/PATH_TO_LOG4J_2_3_2/log4j-api-2.3.2.jar .
cp ~/PATH_TO_LOG4J_2_3_2/log4j-core-2.3.2.jar .
cp ~/PATH_TO_LOG4J_2_3_2/log4j-1.2-api-2.3.2.jar .
No other components are affected.
Qlik Visibility - CVE-2021-44228: Visibility-Client.jar file vulnerability
Looking for guidance on Security vulnerability noted:
The version of Apache Log4j on the remote host is 2.x < 2.3.1 / 2.4 < 2.12.3 / 2.13 < 2.15.0. It is, therefore, affected by a remote code execution vulnerability in the JDNI parser due to improper log validation. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Log4j 1.x, which reached its End of Life prior to 2016, comes with JMSAppender which will perform a JNDI lookup if enabled in Log4j's configuration file, hence customers should evaluate triggers in 1.x based on the risk that it is EOL and whether JNDI lookups are enabled. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
The following paths are showing in our Security scan results:Path:/opt/attunity/visibility/product/v7/java/lib/MapR/visibility-client.jar - Note: Installed version:2.3 and Fixed version:2.3.1Path:/opt/attunity/visibility/product/v7/java/lib/CDH_5.10/visibility-client.jar - Note: Installed version:2.3 and Fixed version:2.3.1
Please advise on guidance.
Qlik Visibility - Spring Framework vulnerability CVE-2022-22965
Looking for guidance on Attunity Visibility software v7.3 impact for Spring Framework vulnerability CVE-2022-22965. PNC Security has requested remediation as per below:
Spring Framework contains a flaw in the CachedIntrospectionResults class in spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java related to insecure introspection when using request parameter binding. This may allow a remote attacker to invoke arbitrary Java class methods and execute arbitrary code.
I've found the reference in your support documentation for the subject CVE vulnerability but there is no mention of Qlik Visibility software. Would appreciate some help.
Operating System: LinuxOperating System Version: RHEL 7.9Product Release: V7.3Environment Type: Production
Thank you,Vikki Turner
Hi @Vikki ,
Visibility is a retired product and is no longer supported