Pega on-premises Apache Log4j Zero Day Vulnerability

General
, , ,
1

For Pega on-premises (MLP 7.3.1 / Tomcat )

Followed the instructions mentioned in the security advisory document (Pegasystems Documentation)..

  • Executed the delete statement ( delete from pegarules.pr_engineclasses where pzclass = ‘JndiLookup.class’ and pzpackage = ‘org/apache/logging/log4j/core/lookup’;
  • Searched for the files starting with log4j in the application server directory and could see only two jars log4j-core-2.3 & log4j-api-2.3 in the directory (Pega7.31\scripts\lib) so just replace them with the latest jars (log4j-api-2.15.0.jar & log4j-core-2.15.0.jar )
  • If the system is configured with SMA then need to replace the log4j-api-2.x jar at \Tomcat\webapps\prsysmgmt\WEB-INF\lib.

Since Jar files are replaced with the latest version, Do we need to update any reference/dependency files which are referring to log4j2 jars in the system?

2

Systems are already updated with 2.15.0 .

As per the latest update Pegasystems Documentation,

Need to upgrade it to 2.16.0. Is it still not safe to be in 2.15.0?

image_comment_845171_1.png
image_comment_845171_1.png1285×618 52.5 KB

3

Hi @Brahmesh@, there were additional vulnerabilities uncovered in 2.15, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 , so when you have a chance please update to 2.16

4

@Eric Rietveld Thanks for the response ..Upgraded it to latest version 2.16.0 , Still Is hotfix required?

I see the hotfix available for Pega 8. X as I don’t see any hotfix is suggested for Pega7.X

5

@Brahmesh@ Hotfixes will be made available for the affected Pega 7 versions as well.

6

@Eric Rietveld So far, we removed the JNDI class and updated log4j jars to 2.16 . As per CVE-2021-45105, log4j 2.17 is also released. Do we need to update log4j jars to this latest version? Do we need to wait for confirmation from Pega about testing 2.17.0.

As per Pega article(Pegasystems Documentation) ,Still it says 2.16.0

  • log4j-api-2.16.0.jar
  • log4j-core-2.16.0.jar
  • log4j-slf4j-impl-2.16.0.jar
  • (possibly) kafka-log4j-appender-1.1.0.jar

NOTE: The 2.16.0 versions of these files are the latest version that Pega has tested.

7

@Brahmesh@, there’s no urgency in patching the libs from 2.16 to 2.17. I suggest to wait and monitor our publications as the story unfolds. See also my other posting on this.

Can you mark this question as addressed for now?