New vulnerabilities were found on Log4J 1.X

[Akash Saini]

Hello Folks,

Could you please help me on this issue. Which probe need to upgrade from avoid the vulnerabilities

Vulnerability in : Log4J 1.X

Description
New vulnerabilities were found on Log4J 1.X, allowing to remotely execute arbitrary code.

Related CVE

CVE-2022-23302
CVE-2022-23305
CVE-2022-23307

Impacted platforms & versions
All versions of Log4j 1.x

Thanks in advance !
Akash Saini

[Ravishu Arora]

Hi Akash,

You can refer to the below article to understand everything about DX UIM and log4j impact:
https://knowledge.broadcom.com/external/article?articleId=230333

------------------------------
Principal Product Manager
Broadcom Software
------------------------------

[Akash Saini]

Hello Ravishu,

Thanks for update -Its related to CVE-2021(https://knowledge.broadcom.com/external/article?articleId=230333)and we already applied all fix,

And my concern for below CVE-
CVE-2022-23302
CVE-2022-23305
CVE-2022-23307

[Ravishu Arora]

Glad to hear that you have applied all fixes already!

At Broadcom, security is a priority for us and we have proactively decided to upgrade our log4j instances to the latest versions. We have already released multiple waves of various probes that have been upgraded to the latest and greatest, and there are more to come.

Please visit the release notes for the probes that you are using in the TechDocs to see the latest release updates for each of them.

------------------------------
Principal Product Manager
Broadcom Software
------------------------------

[Akash Saini]

Hello Folks,

Any one have any article or docs for avoid the vulnerabilities in Log4J 1.X

Related CVE

CVE-2022-23302
CVE-2022-23305
CVE-2022-23307

Impacted platforms & versions
All versions of Log4j 1.x

Thanks in advance !

[Garin Walsh]

The discussion of the exploit usually has this information. The first one says;

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to.

So the mitigation here would be to ensure that the attacker does not have write access and that you aren't using LDAP related to the probe. 

Or stop using the probe that includes the version of the logging utilities. 

Or you could try deleting that class from the affected jar file and see if the code still runs. It might or it might not.

[Akash Saini]

Thanks Garin,