Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 karthigeyan ravichandran (karthigeyanr) Common Wealth Bank of Australia
Common Wealth Bank of Australia
AU
karthigeyanr Member since 2017 12 posts
Common Wealth Bank of Australia
Posted: Dec 20, 2021
Last activity: Dec 21, 2021
Posted: 20 Dec 2021 3:25 EST
Last activity: 21 Dec 2021 8:51 EST
Closed

log4j vulnerability CVE-2021-45105 | Denial of Service attack

Hello,

Does the DB steps (https://docs-previous.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability) given to remove the JNDI lookup class from pr_engineclasses table holds good against the latest log4j vulnerability  CVE-2021-45105? 

Any help is appreciated. Thanks 

***Edited by Moderator Marissa to update Capability tags****
To see attachments, please log in.
Pega Platform Security

Posted: 2 years ago
Posted: 20 Dec 2021 7:39 EST
Eric Rietveld (Eric Rietveld) Principal System Architect
Pegasystems Inc.
NL

Hi @karthigeyanr, no removing the JNDI lookup functionality keeps the StrSubstitutor issue which is at the root of that CVE. Note that there are mitigating factors such as logging format, which makes it unlikely that your Pega system can be DOS'ed through this vulnerability.

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice