Seek help - issue of plugin: Apache Log4j

[YC123]

Hi all,

I am using Qlik Replicate.  When the server is scanned by security tool, the following error is shown.

Plugin: Apache Log4j 2.0 < 2.3.2 / 2.4 < 2.12.4 / 2.13 < 2.17.1 RCE

Plugin: Apache Log4j 2.x < 2.17.0 DoS

I checked that Apache is not installed in this server.  Hence, would like to know if Qlik Replicate is using this plugin?  If yes, how can we fix this issue?

Thank you.

Regards,

[john_wang · Accepted solution]

Hello @YC123 ,

Thanks for your post!

Yes, Qlik Replicate does include Apache Log4j components. However, the related vulnerabilities have already been addressed through fixes provided by both Apache and Qlik. You can find the official details here:

Qlik’s Response to Apache Log4j Vulnerabilities

I’m not sure which Replicate version you’re currently running, I'd like suggest you to upgrade Qlik Replicate to get the fixes. If you still prefer to manually upgrade the Log4j components, please refer to my article below for guidance:

Updating Log4j to 2.17.1 for Qlik Replicate and Qlik Enterprise Manager

Hope this helps.

John.

[YC123]

Thank you, John

[john_wang]

Thanks for your support! @YC123