Software Engineering Institute

Statement Date:   December 21, 2021

References

• https://www.arista.com/en/support/advisories-notices/security-advisories/13425-security-advisory-0070

Statement Date:   December 14, 2021

Vendor Statement

Aruba has issued a security advisory regarding our status in regards to CVE-2021-44228. It can be found at the case reference below. Most of our products are unaffected, but Silver Peak Orchestrator is affected in some configurations. See the advisory for more detail.

References

• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-019.txt

Statement Date:   December 21, 2021

Statement Date:   February 04, 2022

Vendor Statement

Bull Sequana servers are not using the vulnerable component. For BullSequana SA servers availability (Downloads/tools) of GSM_Doctor_v1_06 & Server_utility_cli_2.1.50 with Log4j 2.17 updates.

References

• https://support.bull.com/ols/product/platforms/hw-extremcomp/log4shell
• https://support.bull.com/ols/product/platforms/bullion/bullsequana-sa-servers

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/baidu/brpc-java/actions/runs/191042301/workflow

Statement Date:   December 22, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.beyondtrust.com/blog/entry/security-advisory-apache-log4j2-cve-2021-44228-log4shell

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.bmc.com/s/news/aA33n000000TSUdCAO/bmc-security-advisory-for-cve202144228-cve202145046-log4shell-vulnerability

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.broadcom.com/log4j

Statement Date:   December 22, 2021

Vendor Statement

Brocade has investigated its product line to determine the exposure of Brocade Fibre Channel products from Broadcom. Brocade continues to monitor all sources of information related to these vulnerabilities. Brocade Security Advisory is at: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1651

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/getnelson/nelson/tree/f4d3dd1f1d4f8dfef02487f67aefb9c60ab48bf5

Statement Date:   December 10, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Vendor Statement

We have not received a statement from the vendor.

References

• https://discussions.citrix.com/topic/415000-citrix-products-affected-from-log4j-zero-day-vulnerability-cve-2021-44248/

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.commvault.com/technical-q-a-2/log4j-1-x-2038

Vendor Statement

We have not received a statement from the vendor.

References

• https://blog.cpanel.com/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server/

Statement Date:   January 12, 2022

Vendor Statement

https://cradlepoint.com/vulnerability-alerts/cve-2021-44228-apache-log4j-security-vulnerabilities/

NetCloud OS (NCOS) does not use java, thus, Cradlepoint devices are unaffected by the Log4J vulnerabilities.

The Cradlepoint incident response team investigated, identified and patched vulnerable versions of Log4J in its cloud services, NetCloud Manager (NCM) and NetCloud Perimeter, as patches became available.

Statement Date:   December 18, 2021

Vendor Statement

No products are affected. Customers are NOT affected. There is an impact on some of our web services (eg: customer downloads). Mitigations for CVE-2021-44228 have been applied as of December 14, 2021. Revised mitigations for CVE-2021-44228 and also mitigations for CVE-2021-45046 have been applied as of December 18, 2021.

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.phoronix.com/scan.php?page=news_item&px=Debian-11.2-Released

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.dell.com/support/kbdoc/en-us/000194414/dell-response-to-apache-log4j-remote-code-execution-vulnerability

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.dell.com/support/kbdoc/en-us/000194414/dell-response-to-apache-log4j-remote-code-execution-vulnerability

Statement Date:   March 24, 2022

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/elastic/logstash/issues/13501

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-software-and-cve-2021-44228-aka-log4shell-aka-logjam/

Statement Date:   December 14, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://advisories.nats.io/statements/log4j

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.ramanean.com/forcepoint-products-log4j-vulnerability/

Statement Date:   December 14, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://forescout.force.com/support/s/article/Important-security-information-related-to-Apache-Log4j-utility-CVE-2021-44228
• https://www.forescout.com/blog/forescout%e2%80%99s-response-to-cve-2021-44228-apache-log4j-2/

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.fortiguard.com/psirt/FG-IR-21-245?utm_source=blog&utm_campaign=blog

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.f-secure.com/common-business-en/kb/articles/9226-the-log4j-vulnerabilities-cve-2021-44228-cve-2021-45046-which-f-secure-products-are-affected-what-it-means-what-steps-should-you-take

Statement Date:   January 14, 2022

Vendor Statement

Fujitsu is aware of the security vulnerabilities in software Apache log4j ("Log4Shell").

Affected products are Fujitsu Software ServerView Suite (SVS) and Fujitsu SecDocs. Updates are available.

The Fujitsu PSIRT has issued Fujitsu PSS-IS-2021-121000 on https://security.ts.fujitsu.com (Security Notices) accordingly.

In case of questions regarding this Fujitsu PSIRT Security Notice, please contact the Fujitsu PSIRT (Fujitsu-PSIRT@ts.fujitsu.com).

References

• https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-PSS-IS-2021-121000-Security-Notice-SF.pdf

Vendor Statement

We have not received a statement from the vendor.

References

• https://vulners.com/github/GITHUB:070AFCDE1A9C584654244E41373D86D8

Statement Date:   January 13, 2022

Vendor Statement

Google Cloud is actively following the security vulnerabilities in the open-source Apache “Log4j 2" utility (CVE-2021-44228 and CVE-2021-45046). We are also aware of the reported Apache “Log4j 1.x” vulnerability (CVE-2021-4104). We encourage customers to update to the latest version of Log4j 2. We are currently assessing the potential impact of the vulnerability for Google Cloud products and services. This is an ongoing event and we will continue to provide updates through this page (https://cloud.google.com/log4j2-security-advisory) and our customer communications channels.

Based on our findings, Google Workspace core services for consumer and paid users are not using Log4j 2 and are not impacted by the issues identified in CVE-2021-44228 and CVE-2021-45046. See below for a detailed status of the Workspace core services and other related products.

We recommend Google customers review all third-party apps and solutions accessing their data and validate the security status of those apps with their respective vendors. More details on managing apps authorized to access Google Workspace data are here and customers can review their list of solutions from the Google Cloud Marketplace by logging into their account. We also recommend validating the security status of any apps developed and deployed by customers within their environments.

References

• https://cloud.google.com/log4j2-security-advisory

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.graylog.org/post/graylog-update-for-log4j

Statement Date:   January 04, 2022

Vendor Statement

HIRT-PUB21001 : Apache Log4j Vulnerability https://www.hitachi.com/hirt/publications/hirt-pub21001

References

• https://www.hitachi.com/hirt/publications/hirt-pub21001

Statement Date:   December 18, 2021

Vendor Statement

For published advisories related to the Apache Log4j, please refer to https://www.hitachienergy.com/cybersecurity/alerts-and-notifications

Our cybersecurity notification on Apache Log4j vulnerabilities can be found here: https://search.abb.com/library/Download.aspx?DocumentID=8DBD003132&LanguageCode=en&DocumentPartId=&Action=Launch

References

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD003132&LanguageCode=en&DocumentPartId=&Action=Launch

Vendor Statement

We have not received a statement from the vendor.

References

• https://twitter.com/hostifi_net/status/1469511114824339464
• https://lawrencesystems.com/patching-unifi-against-the-log4j-cve-2021-44228-vulnerability/
• https://lawrencesystems.com/patching-unifi-again-to-6-5-55-this-time-the-log4j-cve-2021-45046-vulnerability/

Vendor Statement

We have not received a statement from the vendor.

References

• https://support.hp.com/us-en/document/ish_5268006-5268030-16

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211215-01-log4j-en
• https://www.huawei.com/en/psirt/security-notices/2021/huawei-sn-20211210-01-log4j2-en

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.ibm.com/blogs/psirt/
• https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log4j-cve-2021-44228-vulnerability/

CERT Addendum

Multiple products affected. See https://www.ibm.com/blogs/psirt/ for information on IBM products.

Statement Date:   December 29, 2021

Vendor Statement

Imperva Threat Research is continuing to monitor, create, test and deploy CVE-specific security rules based on new attack variants for all of our customers. We will keep all our customers notified as this progresses.

We continue to scan and patch vulnerabilities in our products and infrastructure as these CVEs are posted.

References

• Imperva's response concerning this CVE is posted here:
• https://www.imperva.com/blog/how-were-protecting-customers-staying-ahead-of-cve-2021-44228/
• Additional posts may be available:
• https://www.imperva.com/blog/

Vendor Statement

We have not received a statement from the vendor.

References

• https://network.informatica.com/community/informatica-network/blog/2021/12/10/log4j-vulnerability-update
• https://knowledge.informatica.com/s/article/Apache-Zero-Day-log4j-RCE-Vulnerability-updates-for-Informatica-Cloud-and-Cloud-Hosted-Software?language=en_US
• https://knowledge.informatica.com/s/article/Log4J-remediation-for-Informatica-Data-Quality?language=en_US
• https://knowledge.informatica.com/s/article/Apache-log4j-Zero-day-RCE-Vulnerability-CVE-2021-44228-Updates-for-Informatica-On-premises-Products?language=en_US

Statement Date:   December 14, 2021

Vendor Statement

Our security teams are aware of this issue and are in the process of investigating the impact of the Apache log4j security vulnerability on Intel products/software. As with all security vulnerability, this is being treated as a high priority within Intel and Intel will provide our customers with updates as our investigation progresses.

Vendor Statement

We have not received a statement from the vendor.

References

• https://forums.ivanti.com/s/article/Apache-Log4j-Zero-Day-Vulnerability-and-Ivanti-Security-Controls-CVE-2021-44228?language=en_US
• https://forums.ivanti.com/s/article/CVE-2021-44228-Java-logging-library-log4j-Ivanti-Products-Impact-Mapping?language=en_US

Vendor Statement

We have not received a statement from the vendor.

References

• https://docs.jamf.com/technical-articles/Mitigating_the_Apache_Log4j_2_Vulnerability.html

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/
• https://issues.jenkins.io/browse/JENKINS-67353

Vendor Statement

We have not received a statement from the vendor.

References

• https://blog.jetbrains.com/blog/2021/12/13/log4j-vulnerability-and-jetbrains-products-and-services/

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.jitsi.org/t/cve-2021-44228-and-jitsi-components/108844
• https://github.com/jitsi/security-advisories/blob/4e1ab58585a8a0593efccce77d5d0e22c5338605/advisories/JSA-2021-0004.md

Vendor Statement

We have not received a statement from the vendor.

References

• https://kafka.apache.org/cve-list
• https://github.com/microsoft/kafka-connect-cosmosdb/blob/0f5d0c9dbf2812400bb480d1ff0672dfa6bb56f0/CHANGELOG.md

Statement Date:   December 16, 2021

Vendor Statement

Pretty much everyone worldwide is affected by this, and coordinating large-scale response efforts in determining where vulnerable log4j instances are present.

Vendor Statement

We have not received a statement from the vendor.

References

• https://blog.lucentsky.com/2021/12/10/log4j-cve-2021-44228/
• https://twitter.com/LucentSky/status/1469358706311974914

Statement Date:   December 15, 2021

Vendor Statement

Public KB published and being updated - https://kc.mcafee.com/agent/index?page=content&id=KB95091 Includes coverage from our protection products and a link to the registered security bulletin with details on the impact to our products.

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/metabase/metabase/security/advisories/GHSA-vmm4-cwrm-38rj

Statement Date:   December 15, 2021

Vendor Statement

Microsoft's guidance for CVE-2021-44228 can be found at https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ and will be updated as more information becomes available.

References

• https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
• https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition

Vendor Statement

We have not received a statement from the vendor.

References

• https://status.n-able.com/2021/12/10/apache-log4j-vulnerability-updated-6-p-m-est-december-10-2021/

Statement Date:   December 23, 2021

Vendor Statement

The impact to NI products is described in the security advisory at https://www.ni.com/en-us/support/documentation/supplemental/21/ni-response-to-apache-log4j-vulnerability-.html This security advisory will be updated as new information is available.

Questions regarding this advisory can be directed to NI's PSIRT (product-security@ni.com). Additional security information is available at https://ni.com/security.

References

• https://www.ni.com/en-us/support/documentation/supplemental/21/ni-response-to-apache-log4j-vulnerability-.html

Vendor Statement

We have not received a statement from the vendor.

References

• https://security.netapp.com/advisory/ntap-20211210-0007/
• https://security.netapp.com/advisory/ntap-20211218-0001/
• https://security.netapp.com/advisory/ntap-20211215-0001/

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/YfryTchsGD/Log4jAttackSurface/blob/master/pages/NetEase.md

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/search?q=org%3ANetflix+CVE-2021-44228&type=commits

Vendor Statement

We have not received a statement from the vendor.

References

• https://newrelic.com/blog/nerdlog/security-guidance-for-log4j

Statement Date:   June 16, 2022

Vendor Statement

Security Notice: NVIDIA Response to Log4j Vulnerability (CVE-2021-44228) - December 2021

References

• https://nvidia.custhelp.com/app/answers/detail/a_id/5294

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.openhab.org/t/openhab-and-the-log4j-security-vulnerability/129901
• https://www.openhab.org/blog/2021-12-19-openhab-3-2-release.html

Vendor Statement

We have not received a statement from the vendor.

References

• https://talk.openmrs.org/t/urgent-security-advisory-2021-12-11-re-apache-log4j-2/35341

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.opennms.com/en/blog/2021-12-10-opennms-products-affected-by-apache-log4j-vulnerability-cve-2021-44228/

Vendor Statement

We have not received a statement from the vendor.

References

• https://opensearch.org/blog/releases/2021/12/update-to-1-2-1/
• https://opensearch.org/blog/releases/2021/12/update-1-2-2/

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.oracle.com/security-alerts/alert-cve-2021-44228.htmlhttps://www.oracle.com/security-alerts/alert-cve-2021-44228.html

Statement Date:   March 28, 2022

Vendor Statement

Patches for our products are released, internal IT is patched up.

References

• https://kb.paessler.com/en/topic/90213-is-prtg-affected-by-cve-2021-44228

Vendor Statement

We have not received a statement from the vendor.

References

• https://support.pagerduty.com/docs/pagerduty-log4j-zero-day-vulnerability

Vendor Statement

We have not received a statement from the vendor.

References

• https://security.paloaltonetworks.com/CVE-2021-44228

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.papercut.com/kb/Main/Log4Shell-CVE-2021-44228

Statement Date:   December 22, 2021

Statement Date:   December 16, 2021

Vendor Statement

Please consult with our published Red Hat Security Bulletin RHSB-2021-009 for list of affected products, updates, and mitigation options related to this CVE.

References

• https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
• https://access.redhat.com/security/cve/cve-2021-44228

Vendor Statement

We have not received a statement from the vendor.

References

• https://redis.com/security/notice-apache-log4j2-cve-2021-44228/

CERT Addendum

Redis Enterprise Cloud, Enterprise Software and Open Source Redis is not vulnerable.

However, Redis Java Clients - Jedis is vulnerable.

Jedis is a Redis sponsored Java client. It uses the affected library in test suites only. A new Jedis release is now available that mitigates the vulnerability. End users are advised to evaluate their exposure to determine upgrade urgency.

https://redis.com/security/notice-apache-log4j2-cve-2021-44228/

Statement Date:   December 15, 2021

Vendor Statement

Our updated disclosure article is below

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1133605

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.rsa.com/t5/general-security-advisories-and/rsa-customer-advisory-apache-vulnerability-log4j2-cve-2021-44228/ta-p/660501

CERT Addendum

https://community.rsa.com/t5/general-security-advisories-and/rsa-customer-advisory-apache-vulnerability-log4j2-cve-2021-44228/ta-p/660501

Vendor Statement

We have not received a statement from the vendor.

References

• https://developer.sailpoint.com/discuss/t/sailpoint-saas-services-response-to-log4j-remote-code-execution-vulnerability/2345
• https://developer.sailpoint.com/discuss/t/sailpoint-saas-services-response-to-log4j-remote-code-execution-vulnerability/2346
• https://community.sailpoint.com/t5/Community-Announcements/IdentityNow-Log4j-RCE-Vulnerability-Update-Patched-version-of/ba-p/206977
• https://community.sailpoint.com/t5/Community-Announcements/Update-Log4j-Vulnerability/ba-p/206705

Vendor Statement

We have not received a statement from the vendor.

References

• https://help.salesforce.com/s/articleView?id=000363736&type=1

CERT Addendum

https://help.salesforce.com/s/articleView?id=000363736&type=1

Vendor Statement

We have not received a statement from the vendor.

References

• https://layersevensecurity.com/securing-sap-systems-from-log4j-exploits/#:~:text=Log4J%20is%20included%20in%20multiple%20SAP%20applications%20including,official%20response%20for%20details%20of%20all%20impacted%20products.

CERT Addendum

https://layersevensecurity.com/securing-sap-systems-from-log4j-exploits/#:~:text=Log4J%20is%20included%20in%20multiple%20SAP%20applications%20including,official%20response%20for%20details%20of%20all%20impacted%20products.

Vendor Statement

We have not received a statement from the vendor.

References

• https://support.sas.com/en/security-bulletins/remote-code-execution-vulnerability-cve-2021-44228.html

Statement Date:   December 21, 2021

Vendor Statement

On 2021/12/10, Security Onion Solutions released an initial hotfix to address log4j.

On 2021/12/13, Security Onion Solutions released a second hotfix to address log4j.

On 2021/12/21, Security Onion Solutions released Security Onion 2.3.91 which updates Log4j to 2.17.0.

References

• https://blog.securityonion.net/2021/12/security-onion-2390-20211210-hotfix-now.html
• https://blog.securityonion.net/2021/12/security-onion-2390-20211213-hotfix-now.html
• https://blog.securityonion.net/2021/12/security-onion-2391-now-available.html

CERT Addendum

https://blog.securityonion.net/2021/12/security-onion-2390-20211210-hotfix-now.html

Statement Date:   December 15, 2021

Vendor Statement

Please see URL for the full table for the details on individual Proofpoint products. Open source sendmail is covered separately by the "Sendmail Consortium" vendor in the CERT vulnerability note.

References

• https://www.proofpoint.com/us/blog/corporate-news/proofpoints-response-log4j-vulnerability

Vendor Statement

We have not received a statement from the vendor.

References

• https://support.servicenow.com/now?id=ns_search&q=log4j&s=true&pp=kb_article_view
• https://community.servicenow.com/community?id=community_article&sys_id=26ccd67cdb2c0590b5d6e6be1396198f

CERT Addendum

https://support.servicenow.com/now?id=ns_search&q=log4j&s=true&pp=kb_article_view

https://community.servicenow.com/community?id=community_article&sys_id=26ccd67cdb2c0590b5d6e6be1396198f

Statement Date:   December 18, 2021

Vendor Statement

The impact to Siemens products is described in the Security Advisory SSA-661247, published on the Siemens ProductCERT page (https://www.siemens.com/cert/advisories).

In case of questions regarding this Security Advisory, please contact Siemens ProductCERT (productcert@siemens.com).

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf

Statement Date:   January 14, 2022

Vendor Statement

We have not received a statement from the vendor.

References

• https://tech.forums.softwareag.com/t/log4j-zero-day-vulnerability/253849

CERT Addendum

https://tech.forums.softwareag.com/t/log4j-zero-day-vulnerability/253849

Statement Date:   December 18, 2021

References

• ttps://www.solarwinds.com/trust-center/security-advisories/cve-2021-44228
• https://support.solarwinds.com/SuccessCenter/s/article/Server-Application-Monitor-SAM-and-the-Apache-Log4j-Vulnerability-CVE-2021-44228
• https://support.solarwinds.com/SuccessCenter/s/article/Database-Performance-Analyzer-DPA-and-the-Apache-Log4j-Vulnerability-CVE-2021-44228

Vendor Statement

We have not received a statement from the vendor.

References

• https://community.sonarsource.com/t/sonarqube-and-the-log4j-vulnerability/54721

CERT Addendum

https://community.sonarsource.com/t/sonarqube-and-the-log4j-vulnerability/54721

Vendor Statement

We have not received a statement from the vendor.

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

CERT Addendum

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032

Statement Date:   December 16, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.sophos.com/en-us/security-advisories/sophos-sa-20211210-log4j-rce

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/bpangburn/swingset/commit/80c6a542d166f8fe8232d87595fcad7c4028760d

CERT Addendum

"Updated POMs for Log4j 2.16.0. Updated Changelog" https://github.com/bpangburn/swingset/commit/80c6a542d166f8fe8232d87595fcad7c4028760d

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html

CERT Addendum

https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html

Vendor Statement

We have not received a statement from the vendor.

References

• https://kb.vmware.com/s/article/87068?lang=en_US
• https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot

CERT Addendum

https://kb.vmware.com/s/article/87068?lang=en_US

https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot

Statement Date:   December 15, 2021

Vendor Statement

SUSE Linux Enterprise products are not affected by this vulnerability. SUSE Manager is not affected. SUSE Rancher is not affected. SUSE NeuVector is not affected. A component of SUSE OpenStack Cloud (storm) includes log4j, but likely not user reachable.

References

• https://www.suse.com/security/cve/CVE-2021-44228.html
• https://www.suse.com/c/suse-statement-on-log4j-log4shell-cve-2021-44228-vulnerability/
• https://www.suse.com/support/kb/doc/?id=000020526
• https://forums.rancher.com/t/rancher-security-statement-on-log4j-vulnerability/36462

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.synopsys.com/company/newsroom/log4j2-vulnerability.html
• https://community.synopsys.com/s/article/SIG-Security-Advisory-for-Apache-Log4J2-CVE-2021-44228
• https://community.synopsys.com/s/article/Finding-Apache-Log4j-Impacted-Projects-in-Black-Duck

CERT Addendum

https://www.synopsys.com/company/newsroom/log4j2-vulnerability.html

https://community.synopsys.com/s/article/SIG-Security-Advisory-for-Apache-Log4J2-CVE-2021-44228

https://community.synopsys.com/s/article/Finding-Apache-Log4j-Impacted-Projects-in-Black-Duck

Vendor Statement

We have not received a statement from the vendor.

References

• https://jira.talendforge.org/browse/TCOMP-2054

CERT Addendum

https://jira.talendforge.org/browse/TCOMP-2054

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/YfryTchsGD/Log4jAttackSurface/blob/master/pages/Tencent.md

CERT Addendum

https://github.com/YfryTchsGD/Log4jAttackSurface/blob/master/pages/Tencent.md

Vendor Statement

We have not received a statement from the vendor.

References

• https://teslamotorsclub.com/tmc/threads/security-issue-log4j.249501/
• https://thehackernews.com/2021/12/extremely-critical-log4j-vulnerability.html

CERT Addendum

https://teslamotorsclub.com/tmc/threads/security-issue-log4j.249501/

https://thehackernews.com/2021/12/extremely-critical-log4j-vulnerability.html

Statement Date:   December 14, 2021

Vendor Statement

TIBCO continues to work on investigating and identifying mitigations for the Apache Log4J vulnerability (CVE-2021-44228), referred to as the “Log4Shell” vulnerability. TIBCO is providing daily status updates on the investigation and available remediations, located here.

Vendor Statement

We have not received a statement from the vendor.

References

• https://github.com/YfryTchsGD/Log4jAttackSurface

CERT Addendum

https://github.com/YfryTchsGD/Log4jAttackSurface

Statement Date:   December 20, 2021

Vendor Statement

A vulnerable third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application. This vulnerability is fixed in UniFi Network Version 6.5.54 and later.

References

• https://community.ui.com/releases/Security-Advisory-Bulletin-023-023/808a1db0-5f8e-4b91-9097-9822f3f90207
• https://community.ui.com/releases/UniFi-Network-Application-6-5-54/d717f241-48bb-4979-8b10-99db36ddabe1

Statement Date:   January 11, 2022

Statement Date:   December 14, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://ubuntu.com/security/CVE-2021-44228

Statement Date:   January 10, 2022

Vendor Statement

Log4j 2 is being used in some of our products. We have issued an advisory for CVE-2021-44228 which can be found here https://networks.unify.com/security/advisories/OBSO-2112-01.pdf.

References

• https://networks.unify.com/security/advisories/OBSO-2112-01.pdf

Statement Date:   December 20, 2021

Vendor Statement

The MyUPMC DevSecOps team has been closely monitoring the developing Log4j situation and have implemented all patches where appropriate.

Vendor Statement

We have not received a statement from the vendor.

References

• https://steamcommunity.com/discussions/forum/0/3203745634149423223/?ctp=3
• https://github.com/YfryTchsGD/Log4jAttackSurface

CERT Addendum

https://steamcommunity.com/discussions/forum/0/3203745634149423223/?ctp=3

https://github.com/YfryTchsGD/Log4jAttackSurface

Statement Date:   December 22, 2021

Vendor Statement

As of Dec 12, 2021 Veracode is not affected by the Log4j vulnerability. All instances of a vulnerable Log4j in our production and in our on-premise agents, integrations, or virtual appliances has been remediated to Log4j 2.15.0.

As of Dec 22, 2021 Veracode All instances of a vulnerable Log4j in our production and in our on-premise agents, integrations, or virtual appliances has been remediated to Log4j 2.16.0. or 2.17.0

References

• https://community.veracode.com/s/question/0D53n00008GzgQQCAZ/statement-for-customers-on-veracodes-log4j-remediation
• https://community.veracode.com/s/question/0D53n00008HDhDNCA1/veracodes-log4j-remediation-faq

Statement Date:   December 14, 2021

Vendor Statement

Some Veritas products are affected, others are not. We're currently doing additional research given that Apache has stated that some previously suggested mitigations only limit exposure and that a new log4j vulnerability was published today (Tuesday) that can result in a denial of service. We'll provide a primary URL once things have settled down. Things are still too fluid.

References

• https://www.veritas.com/content/support/en_US/article.100052070

Vendor Statement

We have not received a statement from the vendor.

References

• https://lab.wallarm.com/cve-2021-44228-mitigation-update/

CERT Addendum

https://lab.wallarm.com/cve-2021-44228-mitigation-update/

Vendor Statement

We have not received a statement from the vendor.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd#vp

CERT Addendum

Some Webex products are not vulnerable. Please check: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd#vp for information.

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.wowza.com/docs/known-issues-with-wowza-streaming-engine#log4j2-cve

CERT Addendum

https://www.wowza.com/docs/known-issues-with-wowza-streaming-engine#log4j2-cve

Statement Date:   December 17, 2021

Statement Date:   December 21, 2021

Vendor Statement

https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-apache-log4j-xpsa-2021-005.pdf

References

• https://www.xylem.com/siteassets/about-xylem/cybersecurity/advisories/xylem-apache-log4j-xpsa-2021-005.pdf

Vendor Statement

We have not received a statement from the vendor.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

CERT Addendum

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Statement Date:   December 16, 2021

Vendor Statement

Yellowfin has confirmed scenarios in which the software may be vulnerable to these issues.

All Yellowfin users are encouraged to update their environments to one of the following, non-vulnerable versions ASAP:

8.0.10.4

9.7.0.3

This patch upgrades log4j to 2.16, with links available on our latest builds page or via the Security Advisory on our Community page.

References

• https://community.yellowfinbi.com/announcement/notice-critical-vulnerability-in-log4j2

Vendor Statement

We have not received a statement from the vendor.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

CERT Addendum

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd

Statement Date:   December 21, 2021

Vendor Statement

We have not received a statement from the vendor.

References

• https://www.zyxel.com/support/Zyxel_security_advisory_for_Apache_Log4j_RCE_vulnerability.shtml