log4j2 failure (CVE-2021-44228) in cloudera

[#1]

Hello

about log4j2 failure (CVE-2021-44228) in cloudera

there is the KB: https://my.cloudera.com/knowledge/Resolution-for-TSB-2021-545---Critical-vulnerability-in-log4j2?id=...

instructs to run the script to remove a class in the jar etc.

our doubt is, do we need to run this script in any version of CM / CDH or just the version from 6.x.x?

[#2]

Previously asked and answered in this thread:

log4j2 vulnerability (CVE-2021-44228)

[#3 · Accepted solution]

thank you @ask_bill_brooks 

I had seen this thread you passed, but it doesn't explicitly say which version of CM/CDH to run github's log4j script procedure.

but I will consider version 5.x and 6.x to run this script.

[#4]

Hi @yagoaparecidoti 

The log4j CVE-2021-44228 is fixed in 7.1.7 SP1

https://docs.cloudera.com/cdp-private-cloud-base/7.1.7/runtime-release-notes/topics/rt-pvc-cve-sp1.h...

[#5]

hi @PrathapKumar 

thanks for the answer! 😉

but, I had already seen this KB from fixed CVE 😊