Pega on-premises Apache Log4j Zero Day Vulnerability
For Pega on-premises (MLP 7.3.1 / Tomcat )
Followed the instructions mentioned in the security advisory document (https://docs-previous.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability)..
- Executed the delete statement ( delete from pegarules.pr_engineclasses where pzclass = 'JndiLookup.class' and pzpackage = 'org/apache/logging/log4j/core/lookup';
- Searched for the files starting with log4j in the application server directory and could see only two jars log4j-core-2.3 & log4j-api-2.3 in the directory (Pega7.31\scripts\lib) so just replace them with the latest jars (log4j-api-2.15.0.jar & log4j-core-2.15.0.jar )
- If the system is configured with SMA then need to replace the log4j-api-2.x jar at \Tomcat\webapps\prsysmgmt\WEB-INF\lib.
Since Jar files are replaced with the latest version, Do we need to update any reference/dependency files which are referring to log4j2 jars in the system?
Accepted Solution
Updated: 22 Dec 2021 4:20 EST
Pegasystems Inc.
NL
@BRAHMESH@, there's no urgency in patching the libs from 2.16 to 2.17. I suggest to wait and monitor our publications as the story unfolds. See also my other posting on this.
Can you mark this question as addressed for now?
Updated: 15 Dec 2021 13:47 EST
Skandiabanken
SE
Systems are already updated with 2.15.0 .
As per the latest update https://docs-previous.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability#OnPrem,
Need to upgrade it to 2.16.0. Is it still not safe to be in 2.15.0?
Pegasystems Inc.
NL
Hi @BRAHMESH@, there were additional vulnerabilities uncovered in 2.15, see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 , so when you have a chance please update to 2.16
Skandiabanken
SE
@Eric Rietveld Thanks for the response ..Upgraded it to latest version 2.16.0 , Still Is hotfix required?
I see the hotfix available for Pega 8. X as I don't see any hotfix is suggested for Pega7.X
Skandiabanken
SE
@Eric Rietveld So far, we removed the JNDI class and updated log4j jars to 2.16 . As per CVE-2021-45105, log4j 2.17 is also released. Do we need to update log4j jars to this latest version? Do we need to wait for confirmation from Pega about testing 2.17.0.
As per Pega article(https://docs-previous.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability) ,Still it says 2.16.0
- log4j-api-2.16.0.jar
- log4j-core-2.16.0.jar
- log4j-slf4j-impl-2.16.0.jar
- (possibly) kafka-log4j-appender-1.1.0.jar
NOTE: The 2.16.0 versions of these files are the latest version that Pega has tested.
Accepted Solution
Updated: 22 Dec 2021 4:20 EST
Pegasystems Inc.
NL
@BRAHMESH@, there's no urgency in patching the libs from 2.16 to 2.17. I suggest to wait and monitor our publications as the story unfolds. See also my other posting on this.
Can you mark this question as addressed for now?