When does pega plan to provide the search image with Elastic 7.16.3 that addresses log4j vulenrability?
Given that setting the JVM argument -Dlog4j2.formatMsgNoLookups=true only mitigates the Log4j day zero vulnerability and not remediates it we are looking to get an updated pega search dock image without the log4j vulnerabilites.
Updated: 25 Feb 2022 6:07 EST
Pegasystems Inc.
GB
@JibinMat please can you take a look at all the recommendations given in the article "Security Advisory: Apache Log4j JNDI Zero Day Vulnerability"?
This setup was only supported with Elasticsearch version 5.6.9, which uses the vulnerable Log4j components.
The main recommendations relate to updating to the fixed versions.
See documentation here.
Also note the following:
For versions 8.2 – 8.6, Pega has updated both the main major/minor version of Pegasystems Search (example: “8.5”) and the latest patch version of that major/minor version (example “8.5.5”). Either of these Search Docker images are applicable to all Pega patch versions within the minor version (example: both “8.5” and “8.5.5” apply to 8.5, 8.5.1, 8.5.2, 8.5.3, 8.5.4, and 8.5.5).
Are you able to download the 8.4 or 8.4.6 docker image?
@JibinMat please can you take a look at all the recommendations given in the article "Security Advisory: Apache Log4j JNDI Zero Day Vulnerability"?
This setup was only supported with Elasticsearch version 5.6.9, which uses the vulnerable Log4j components.
The main recommendations relate to updating to the fixed versions.
See documentation here.
Also note the following:
For versions 8.2 – 8.6, Pega has updated both the main major/minor version of Pegasystems Search (example: “8.5”) and the latest patch version of that major/minor version (example “8.5.5”). Either of these Search Docker images are applicable to all Pega patch versions within the minor version (example: both “8.5” and “8.5.5” apply to 8.5, 8.5.1, 8.5.2, 8.5.3, 8.5.4, and 8.5.5).
Are you able to download the 8.4 or 8.4.6 docker image?
JPMorgan Chase
US
@MarijeSchillern yes we are using the 8.4.6 docker image but it still has the vulnerable jar, the fix provided with that version is to set the JVM argument -Dlog4j2.formatMsgNoLookups=true and does not provide the remediated 2.17 version jars.
Pegasystems Inc.
GB
JPMorgan Chase
US
@MarijeSchillern Yes the highlighted hotfix has been installed.
Updated: 2 Mar 2022 8:07 EST
Pegasystems Inc.
GB
@JibinMat the latest latest Stream service hotfix for 8.4.6 is HFIX-82196
That contains the following hotfixes: HFIX-82196 Log4j (KAFKA) - CVE-2021-44228/45046 - Log4j 2.17 Update (8.4.6) HFIX-82091 Log4j vuln (Kafka) - CVE-2021-44228 - (8.4.6)
Before installation:
Proprietary information hidden 2.11.1
After installation:
1.1.0..8. 2.17.0
Could you please provide the Scan file of this environment so we can check why the jars are not correct?