You are not logged in. Click here
to log in.
Codebeamer Application Lifecycle Management (ALM)
Apache Log4j vulnerability and fixes
Table of Contents
DescriptionCVE-2021-44224A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). For more information, see: Source: CVE-2021-44224 CVE-2021-44228Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Source: Apache Log4j Security Vulnerabilities
CVE-2021-45046It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. Source: Apache Log4j Security Vulnerabilities
None of the codebeamer versions are affected by this security issue, user input is not used in Thread Context Map or Context Lookup.
CVE-2021-45105Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack. Source: Apache Log4j Security Vulnerabilities
None of the codebeamer versions are affected by this security issue, user input is not used in Thread Context Map or Context Lookup.
CVE-2021-44832Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
None of the codebeamer versions are affected by this security issue, JDBC Appender is not used by codebeamer by default.
Fixing the issueCodebeamer uses two versions of Apache Log4j:
To mitigate the issue (CVE-2021-44228, CVE-2021-45046), Intland Software releases codebeamer 20.11-SP13 ( To mitigate the issue without updating to a new service pack, follow the relevant steps below.
In codebeamer 9.5 (though not supported) this problem does not occur, as there is no Log4j 2.x.x in use in that version.
Patch
Hosted clients
Fix for CVE-2021-44228This fix works with:
In Log4j 2.12.0 and 2.14.0 (both codebeamer supported versions), this issue can be solved by setting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true.
After setting environment variables, restart codebeamer.
Fix for CVE-2021-442288 and CVE-2021-45046 (Linux only)To mitigate the issue, users have to remove the JndiLookup class from the classpath, by following these steps:
Fix for CVE-2021-442288 and CVE-2021-45046 (Windows and Linux)To mitigate the issue, users have to replace the log4j-*.jar files:
Fix for codebeamer 21.09-SP2 in docker containerFor more information, see: Testing the fixThis site provides help in testing whether fixing the issue was successful: https://log4shell.huntress.com/ To run the test, follow these steps:
|
codebeamer Overview codebeamer Knowledge Base Services by Intland Software |
This website stores cookies on your computer. These cookies are used to improve your browsing experience, constantly optimize the functionality and content of our website, furthermore helps us to understand your interests and provide more personalized services to you, both on this website and through other media. With your permission we and our partners may use precise geolocation data and identification through device scanning. You may click accept to consent to our and our partners’ processing as described above. Please be aware that some processing of your personal data may not require your consent, but you have a right to object to such processing. By using our website, you acknowledge this notice of our cookie practices. By accepting and continuing to browse this site, you agree to this use. For more information about the cookies we use, please visit our Privacy Policy
.Your preferences will apply to this website only.
Note that user-behavior analytics are being captured on this server for the purpose of improving the Codebeamer user experience.
anonymous
Hotkeys