Bronze ⭐️⭐️⭐️

Question

log4j2 vulnerability (CVE-2021-44228)

39 replies
44719 views
Translate All

Hello,

I wanted to ask if there's a page / instructions / info regarding the recent log4j2 vulnerability (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) and how it can affect Cloudera CDH setups? If it does affect, what are the recommended mitigations on it?

Thanks,

Mor

MartinTerreni

Silver ⭐️⭐️

It is in deed an important question.

Translate

RajeshTripathy

Silver ⭐️

Following - Cloudera please provide recommendations as this is really urgent.

Translate

Shahrukh

Gold ⭐️

Please go through below apache docs, its might help

https://logging.apache.org/log4j/2.x/manual/migration.html

Translate

mclaren

Silver ⭐️

I upgraded log4j to 2.17 0, but the following error occurred when restarting hiveserver2:

微信图片_20211224160407.png

Translate

Hanumantha

Silver ⭐️⭐️

Hi All,

Is there any impact of CVE-2021-44228 - log4j Arbitrary RCE on CDH 5.x and 6.x??

Regards,

Hanu

Translate

cjervis

Community Manager

Cloudera platform security teams are actively assessing the impact to our on-premises and cloud products and will provide an impact analysis update to customers as soon as possible.

Translate

Keep the questions coming

sri840

Silver ⭐️⭐️

Hi Team,

Currenlty in our organization we are using Cloudera 6.3.1 express edition, recently our company security team came up with log4j CVE-2021-44228 vulnerable, Could you please suggest due to this any problem for cloudera ?

Thanks

Srikanth

Translate

ThomasHopewell

Silver ⭐️⭐️

I second this question. I currently administer a CDH 5.16 cluster that we're in the process of upgrading to CDP 7.x. Is there a statement from cloudera about the extent of the vulnerablility in their products and how we can go about patching it?

Translate

sri840

Silver ⭐️⭐️

Hi Thomas@ThomasHopewell

Could you please refer to below url , this statement came from apache, but not from Cloudera.

https://logging.apache.org/log4j/2.x/security.html

Thanks

Srikanth

Translate

gauravsuri

Silver ⭐️

Hi Team,

There is a vulnerability reported for Log4J in in the below link:-

https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

As per our knowledge, NIFI uses LOGback which is a successor of Log4J, so we should not be having any issues/vulnerabilities with NIFI. But, we wanted to be sure of the same. Please share if in case anyone has any thoughts for NIFI over this.

We are using NIFI 1.8 currently in our organization which uses Logback 1.1.3

Translate

Eric_B

Silver ⭐️⭐️⭐️

Hive I believe is vulnerable and running 2.10.

Translate

dward4

Silver ⭐️

I'm also curious about hive, not sure how to remediate.

Translate

Eric_B

Silver ⭐️⭐️⭐️

Obviously, the best solution would be to replace all jars with the latest Log4j2 jars, but the way Cloudera does things now it might break things. In the long term, better to wait for them to make a statement.

Here's a link that may help, look under workarounds: https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/

Translate

cjervis

Community Manager

All, please read the Cloudera blog article on this topic:

Cloudera Response to CVE-2021-4428

Translate

Keep the questions coming

Eric_B

Silver ⭐️⭐️⭐️

The TSB is not available unless you have a Knowledge Base subscription. Given the severity of the problem, will this information be made available to the public?

Translate

ask_bill_brooks

Platinum ⭐️

@Eric_B Yes. There is a link for non-customers of Cloudera in the blog article linked above. It's at the end of the paragraph beginning "What Cloudera products and versions are affected?"

Translate

Bill Brooks, Community Moderator Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button.

Baxy

Silver ⭐️

Latest Cloudera Hive JDBC driver 2.6.15 contains shaded log4j2 v2.13.3 (according to pom.xml in META-INF/maven/org.apache.logging.log4j/log4j-core)

Translate

SharonSofer

Silver ⭐️⭐️

Hi,

I am looking for an official solution to Log4j2 vulnerability - https://www.lunasec.io/docs/blog/log4j-zero-day/.
I could find on GIT Hub: https://github.com/cloudera/cloudera-scripts-for-log4j, but a JAR manipulation is odd to me, why not replace the JARs at all locations?

Where can I find an official solution?

Thanks in advance

Sharon

Translate

SharonSofer

Silver ⭐️⭐️

I happen to find this: https://my.cloudera.com/knowledge/Resolution-for-TSB-2021-545---Critical-vulnerability-in-log4j2?id=332012 but it is pointing to the same JAR manipulation rather than fully upgrade.

Translate

ebeb

Gold ⭐️⭐️

The script provided in https://github.com/cloudera/cloudera-scripts-for-log4j to delete the JndiLookup.class from log4j jar may have an issue if command zip or unzip is not installed on the cluster nodes. The script should initially check for yum list zip and unzip modules if available and abort if not found. Else it will give a finished message even though it had errors and didnt run successfully like below:

Completed removing JNDI from /opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/share/doc/search-1.0.0.7.1.6.0/examples/test-documents/testJPEG_EXIF.jpg.tar.gz
Backing up to '/tmp/tmp.FsVTS5Rg9y//opt/cloudera/cm/lib/solr-upgrade-1.0.0.7.1.7.0-547.tar.gz.backup'
Patching '/opt/cloudera/cm/lib/solr-upgrade-1.0.0.7.1.7.0-547.tar.gz'
Running on '/tmp/tmp.Yxjh6FQYgS'
Backing up files to '/tmp/tmp.TsL7gbbmHR'
Completed removing JNDI from jar files
./cm_cdp_cdh_log4j_jndi_removal.sh: line 114: unzip: command not found
grep: /tmp/unzip_target/**/*.jar: No such file or directory
Completed removing JNDI from nar files
Recompressing
Completed removing JNDI from /opt/cloudera/cm/lib/solr-upgrade-1.0.0.7.1.7.0-547.tar.gz
INFO : Finished

Translate

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.