Apache Log4j lookup substitution (CVE-2021-44228)

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2021-073 CVE-2021-44228 , CVE-2021-45046 , CVE-2021-45105 12/09/2021 low v2

Vulnerability details

A vulnerability in Log4j dependency may allow a remote attacker with a specially forged server to perform a Denial of Service or Information Leakage of server memory. SVC is not vulnerable to CVE-2021-45105.

Impacted products

ProductsSeverityDetail
Stormshield Visibility Center low Official fix available

Revisions

Version Date Description
v1 Initial release
v2 Added 1.6.1 fix


Stormshield Visibility Center

CVSS v3.1 Overall Score: 2.9      

Analysis

Impacted version

A vulnerability in Log4j dependency may allow a remote attacker with a specially forged server to perform a Denial of Service or Information Leakage of server memory.

An official fix is available.
  • SVC <= 1.6.0

Workaround solution

Solution

User that cannot update for some reason, can disable all lookups in Log4j logs and effectively avoid the vulnerability.

Run the following command via SSH with root privileges :
zip -q -d /data/logstash/logstash-core/lib/jars/log4j-core-*.jar org/apache/logging/log4j/core/lookup/ JndiLookup.class
  • Please upgrade to SVC 1.6.1 (official fix)


Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Network High High Required Unchanged Low None Low
CVSS Base score: 3.1 CVSS Vector: (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L)
Exploit Code Maturity Remediation Level Report Confidence
Proof of concept code Official fix Confirmed
CVSS Temporal score: 2.8 CVSS Vector: (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C)
Confidentiality Requirement Integrity Requirement Availability Requirement
High Low Low
CVSS Environmental score: 2.9 CVSS Vector: (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C/CR:H/IR:L/AR:L/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI:X/MA:X)


Acknowledgements

Apache Log4j security advisory: https://logging.apache.org/log4j/2.x/security.html