CVE-2021-44832 (Vulnerability to RCE via JDBC Appender) ​

Context ​

Following the vulnerabilities CVE-2021-44228, CVE-2021-45105 & CVE-2021-45046 found on Log4j, a new vulnerability has been recently found on the library Log4j.

Details information are provided here, on Apache Log4j website.

Impact ​

Indexima software is not using the JDBC Appender, so we consider the risk as low.

Mitigation ​

  • Indexima has released on 7th Jan 2022 a service pack (2021.5.sp5) containing the library Log4j 2.17.1 that fixes this vulnerability.

Workaround (Replace Log4j2 library) ​

  • Download the 3 JAR files (version 2.17.1) from https://download.indexima.com/libs/log4j/
  • For the 3 Indexima components: Galactica & Visualdoop2 (& Ranger Client if used), after unzipping the Install file, in the directory lib, replace the 3 following Jar files with the ones provided right above
    • log4j-api-2.XX.0.jar
    • log4j-core-2.XX.0.jar
    • log4j-slf4j-impl-2.XX.0.jar

INFO

This change is compatible with all currently supported Indexima versions

Versions ​

  • 7th Jan 2022: initial Version