Qlik’s Response to Apache Log4j Vulnerabilities: CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832

[Katie_Davis]

Latest update as of Feb. 15, 2022. All current threats have been addressed. 

Further updates will be made as new information becomes available. 

[Katie_Davis]

Qlik has been diligently reviewing and testing our product suite since we’ve become aware of the Apache Log4j vulnerability mid-December.  We want to ensure Qlik users that your security is our upmost priority. We have addressed multiple vulnerabilities through a series of product patches for supported affected versions and we recommend you update to the most recent releases available, shown in the chart below.

Log4j versions before v2.16 presented the highest threat and all exposed Qlik products have provided patches with at least v2.16 and will all be updated to v2.17.1 or later under the regular release schedule as we are not vulnerable to the CVEs related to 2.17.0

We’d like to direct you to our FAQ document to review should you have any further questions, and we encourage you to comment with any additional questions.

The following products are not affected:

• Qlik Sense Enterprise, all supported versions
• Qlik Sense Enterprise SaaS
• QlikView, all supported versions
• Nprinting, all supported versions
• Qlik Alerting, all supported versions
• Qlik Web Connectors, all supported versions
• Qlik RepliWeb and ARC, all supported versions
• AIS, including ARC, all supported version
• Nodegraph
• AutoML
• Qlik Catalog supported versions before May 2021 are not affected
• Blendr
• Qlik Data Transfer
• Salesforce and SAP Connectors are not affected
• Qlik Forts
• ODBC Connector Package
• REST Connectors
• Qlik Sense Business

The following products are under review:

• Attunity Visibility
  
  

The following products are affected. Qlik has provided patches linked here; customers are advised to install the patches at their earliest convenience.  

Downloads can be accessed by visiting our new Downloads page  on Qlik Community when signed in with your Qlik ID , then selecting the product then the latest release.

Affected Product Version	CVE-2021-44228	CVE-2021-45046	CVE-2021-45105	CVE-2021-44832	Recommended Action	Log4J Version included in patch
Compose 2021.8	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 2021.8 SR01	Up to 2.16.0
Compose 2021.5	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 2021.5 SR01	Up to 2.16.0
Compose 2021.2	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 2021.2 SR01	Up to 2.16.0
C4DW 7.0	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 7.0 2021 SR04	Up to 2.16.0
C4DW 6.6.1	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 6.6.1 SR03	Up to 2.16.0
C4DW 6.6	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 6.6.0 SR06	Up to 2.16.0
C4DL 6.6	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 6.6.0 SR09	Up to 2.16.0
Replicate 2021.11	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install version published 22 Dec 2021	Up to 2.16.0
Replicate 2021.5	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 2021.5 SR 05	Up to 2.16.0
Replicate 7.0	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 7.0.0 SR05	Up to 2.16.0
Replicate 6.6	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 6.6.0 SR06	Up to 2.16.0
QEM 2021.11	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install version published 22 Dec 2021	Up to 2.16.0
QEM 2021.5	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 2021.5 SR05	Up to 2.16.0
QEM 7.0	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 7.0.0 SR05	Up to 2.16.0
QEM 6.6	Vulnerable, solved by patch	Vulnerable, solved by patch	Not vulnerable	Not vulnerable	Install 6.6.0 SR03	Up to 2.16.0
Catalog 4.12.0, 4.12.1	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Not Vulnerable, JDBC Appender not configured	Install 4.12.2	Up to 2.17.0
Catalog 4.11.0, 4.11.1	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Not Vulnerable, JDBC Appender not configured	Install 4.11.2	Up to 2.17.0
Catalog 4.10.0, 4.10.1, 4.10.2	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Not Vulnerable, JDBC Appender not configured	Install 4.10.3	Up to 2.17.0
GeoAnalytics Server - 4.32.3 and 4.23.4	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Install 4.32.5	Up to 2.17.1
GeoAnalytics Server - 4.27.3 - 4.19.1	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Install 4.27.4 – 4.19.2	Up to 2.17.1
GeoAnalytics Plus - 5.31.1 and 5.31.2	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Install 5.31.3	Up to 2.17.1
GeoAnalytics Plus - 5.30.1-5.29.4	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Install 5.30.2 – 5.29.5	Up to 2.17.1
GeoAnalytics Plus - 5.28.2-5.27.5	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Install 5.28.3 – 5.27.6	Up to 2.17.1
GeoAnalytics Plus - 5.26.5	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Vulnerable, solved by patch	Install 5.26.6	Up to 2.17.1

Please keep in mind that Qlik's on-premise (or client-managed) data integration products are intended to only be accessed on an internal network; therefore any potential impacts of CVE-2021-44228 should be mitigated by your internal network and access controls.

For information on supported versions, please visit the Product Support Lifecycle

Please subscribe to our Support Updates blog for continued updates. 

Thank you for choosing Qlik, 

Qlik Global Support

Change Log:

• Post Created Dec. 11, 2021
• Dec. 11, 2021 1:30pm EST: Updated article to specify which products were confirmed as not affected or still under evaluation
• Dec. 12, 2021 2:00pm EST: Updated to state that QCS was not affected; added additional products as under evaluation

• Dec. 13, 2021 12:15pm EST: Updated to specify which versions applied to not affected products; added changelog.

• Dec. 13, 2021 3:15pm EST: Updated to specify which versions are affected with steps to mitigate and which products we are still evaluating.

• Dec. 13, 2021 5:10pm EST: Added GeoAnalytics Plus mitigation, and expanded "not affected" section to further products. 5:55pm EST added AIS to not affected list.

• Dec. 14, 2021 2:10pm EST: Added Qlik Catalog, Blendr, and Qlik Data Transfer to reviewed list. Added mitigation steps for Qlik Catalog.

• Dec. 14, 2021 2:45pm EST: Added JDBC, Salesforce and SAP Connectors to the not affected list.
• Dec. 15, 2021 3:05pm EST: Added Patch schedule, and the following items to NOT affected: Qlik Forts, ODBC Connector, REST connectors, and Qlik Sense Business. 

• Dec. 16, 2021 1:15pm EST: Updated Catalog version details in Patch schedule. 

• Dec. 17, 2021: 3:25pm EST: Mitigation steps for Compose, Replicate, and QEM were updated
• Dec. 20, 2021 9:00am EST: Updated link to Catalog patches.

• Dec. 20, 2021 1:15pm EST: Updated top post for status of CVE-2021-45105 and language around Catalog to be 'Hotfix' with full version patches in early Jan. 2022 in published.

• Dec. 21, 2021 3:45pm EST: Updated Catalog to be 'Service Releases' with full version 2.17 published to downloads page. 

• Dec. 22, 2021 8:30am EST: Compose 2021.8 released on Qlik Download pages
• Dec. 28, 2021 10:40am EST: Compose 2021.2 -- SR1, Replicate 2021.5 -- SR5, and QEM 2021.5 -- SR5 released on Qlik Download pages and marked as published. 12:00pm combined mitigation links with Patch release schedule chart.
• Dec. 30, 2021 11:00am EST: Patch Release published for C4DW 7.0 - 2021 -- SR4
• January 6, 2021 9:30am EST: Updated expected time for GeoAnalytics patches to "Early January".
• January 11, 2022 7:00am EST: Updated to reflect all GeoAnalytics patches as published.
• January 14, 2022 2:00pm EST: Marked the following patches as published: C4DW 6.6.0 -- SR06,C4DW 6.6.1 -- SR03, C4DL 6.6.0 -- SR09, Replicate 6.6.0 -- SR06, Replicate 7.0.0 -- SR05, QEM 6.6.0 -- SR03, QEM 7.0.0 -- SR05
• January 20, 2022 3:15pm EST: Clarified that there are two patches for GeoAnalytics November 2021. Patch 2 updates log4j to 2.17.0

• February 15, 2022 4:00pm EST: Updated chart to breakout vulnerabilities per product, reflect the latest patch versions to upgrade to, changed post title, and clarified intro statement.

[kalpesh97]

Hello, 

I have been reading this thread and had a question. Currently, we are running following versions:

Replicate: 2021.05.1186
Enterprise manager: 2021.05.498
Compose: 7.0.0.195

Instead of upgrading the products, can we replace just the log4j jar files with 2.17.1? Is it possible to do this for Replicate and/or EM since they are relatively recent? 

Appreciate your help. 

[john_wang]

Hello Krishna, @sahiraj15 

Thanks for you following up.

Reg

---

Any update on the patch for QEM and QReplicate v7.0?

---

 we are proactively working on it, will update the final status in a couple of days.

Regards,

John.

[Larry_QDI]

Hi @kalpesh97,

In the table above, there is a link with steps to mitigate. The article provides detailed instructions for replacing just the log4j jar files. If you are using Replicate on Linux, scroll down on the page and note the comments from @john_wang regarding corrections to the characters to use.

Larry

[john_wang]

Hello @kalpesh97 , Larry,

Regarding your doubt:

---

Replicate: 2021.05.1186
Enterprise manager: 2021.05.498
Compose: 7.0.0.195

Instead of upgrading the products, can we replace just the log4j jar files with 2.17.1? Is it possible to do this for Replicate and/or EM since they are relatively recent? 

---

No, you cannot, because in these versions the log4j jars version is 2.10/2.11 (it's too low). You need upgrade Replicate and Enterprise Manager to latest build of 2021.5 (which contains log4j 2.16) then you may manually upgrade to log4j 2.17.1 manually. 

It's same for Compose,  upgrade first (for example the log4j-core-2.10.0.jar will upgrade to log4j-core-2.14.1.jar) then replace the jars manually from 2.14.1 to 2.17.1. see update to log4j 2.17.1 .

Feel free to let me know if you need any additional information,

John.

[Gaurav2]

Hi, This is related to Qlik replicate. We are using Nov 2021 release. We first applied the mitigation steps:

1) add string in rependctl.sh

2) replace the vulnerable jar with non vulnerable jar ( log4j-core-nolookup-<version#>.jar)

Now to apply Log4j fix ie SR1/build 165 , do we need to remove the above two mitigation steps before applying the areplicate-2021.11.0-165.x86_64.rpm?

[john_wang]

Hello @Gaurav2 ,

Regarding your question:

Hi, This is related to Qlik replicate. We are using Nov 2021 release. We first applied the mitigation steps:

1) add string in rependctl.sh

2) replace the vulnerable jar with non vulnerable jar ( log4j-core-nolookup-<version#>.jar)

Now to apply Log4j fix ie SR1/build 165 , do we need to remove the above two mitigation steps before applying the areplicate-2021.11.0-165.x86_64.rpm?

---

I'd like suggest you to *MOVE* these files (the .sh and the 2 jars) to other location (out of Replicate installation folder) and let the installation program to COPY new ones to the corresponding folder.

Once more, the latest build Replicate contains log4j 2.16. You may manually update it to 2.17.1 if it's necessary.

Regards,

John.

[Gaurav2]

Hi All / @john_wang ,

Thank you for your reply. We don't need to move these files.

I had raised the case with Qlik and here is the response:

No, you don't need to remove anything before upgrade.
Just do the upgrade as always.

No post-upgrade mitigation is required.
This version is already patched with the fixes for log4J Vulnerabilities.

[john_wang]

Hello @Gaurav2 ,

Thank you so much for your update.

I will double-confirm and come back with our findings later. 

I know it's no harm but I'd like to make things clear.

Regards,

John.

[john_wang]

Hello @Gaurav2 ,

I'd confirmed with my team the below suggestion is inaccurate:

Thank you for your reply. We don't need to move these files.

I had raised the case with Qlik and here is the response:

No, you don't need to remove anything before upgrade.
Just do the upgrade as always.

No post-upgrade mitigation is required.
This version is already patched with the fixes for log4J Vulnerabilities.

---

The best approach is renaming the jar files (log4j-core-nolookup-2.14.1.jar) to their original file name (log4j-core-2.14.1.jar) before upgrade.

or as I said before, remove the files out of Replicate installation folder.

The reason is Replicate installation program will try to remove the old jar files. if it cannot find it, a warning reported:

warning: file /opt/attunity/replicate/endpoint_srv/externals/log4j-core-2.14.1.jar: remove failed: No such file or directory

In your case, the installation program cannot remove the useless jar file, the unnecessary jar file left in the folder ,  you have 2 versions log4j-core jar files after the upgrade done. please remove the "log4j-core-nolookup-2.14.1.jar" manually and restart the services.

Let me know if you need any additional information.

Regards,

John.

[Gaurav2]

Thanks @john_wang  for your help.

I have removed below 2 files which are the part of mitigation step after upgrade :

1) log4j-core-2.14.1.jar-vulnerable

2) log4j-core-nolookup-2.14.1.jar 

Moving forward to upper environments, I will rename the jar files (log4j-core-nolookup-2.14.1.jar) to their original file name (log4j-core-2.14.1.jar) before upgrade.