question Re: What all vulnerabilities related to Log4j1 and Log4j2 are fixed/addressed in CDH 6.3.4? in Support Questions

What all vulnerabilities related to Log4j1 and Log4j2 are fixed/addressed in CDH 6.3.4?

YogeshKumar — Wed, 16 Nov 2022 19:03:47 GMT

I believe below mentioned CVEs are either addressed or fixed through patching in CDH 6.3.4 -

CVE-2021-4104 (Log4j1) - as per this article, CDH user doesn't need to do anything to fix this vulnerability.
CVE-2021-44228 (Log4j2) - as per this article, patches are available for this vulnerability for CDH 6.3.4.

But apart from above vulnerabilities, there are few more vulnerabilities of critical, high and moderate severity in Log4j1 and Log4j2 which are -

Log4j1 - https://logging.apache.org/log4j/1.2/index.html

CVE-2019-17571 is a high severity issue targeting the SocketServer.
CVE-2022-23302 is a high severity deserialization vulnerability in JMSSink.
CVE-2022-23305 is a high serverity SQL injection flaw in JDBCAppender that allows the data being logged to modify the behavior of the component.
CVE-2022-23307 is a critical severity against the chainsaw component in Log4j 1.x.

Log4j2 - https://logging.apache.org/log4j/2.x/security.html

CVE-2021-45046 (critical severity) - Apache Log4j2 Thread Context Lookup Pattern vulnerable to remote code execution in certain non-default configurations.
CVE-2021-45105 (moderate severity) - Apache Log4j2 does not always protect from infinite recursion in lookup evaluation.

[EDITED] - Is CDH 6.3.4 exposed to these, above mentioned, other CVEs? And if so -

Are there any patches released for these vulnerabilities as well for CDH 6.3.4?

Re: What all vulnerabilities related to Log4j1 and Log4j2 are fixed/addressed in CDH 6.3.4?

ask_bill_brooks — Wed, 16 Nov 2022 16:24:06 GMT

@YogeshKumar

I'm curious as to exactly how you have determined that, because you have identified that there are previously identified vulnerabilities of critical, high and moderate severity in Log4j1 and Log4j2, that CDH 6.3.4 is exposed to those same vulnerabilities?

Re: What all vulnerabilities related to Log4j1 and Log4j2 are fixed/addressed in CDH 6.3.4?

YogeshKumar — Wed, 16 Nov 2022 19:02:45 GMT

@ask_bill_brooks Thanks for the quick response.

I am not yet sure that CDH 6.3.4 is exposed to those Log4J1 and Log4J2 vulnerabilities or not.

Maybe I should update my question that "...if CDH 6.3.4 is affected by those other CVEs then are there any fixes/patches or not?"

Thank you for pointing that out.