AGECOM products and Log4j Vulnerability


 Product:
 All Products > Log4j > Version All

 Platform(s):
 All

 Edition(s):
 All

 Doc Number:
 1000123
Published 17-Jan-2022
Last Updated: 17-Jan-2022

 General Information

Are AGECOM products affected by the Log4j vulnerabilities reported under the following CVEs: CVE-2021-4104, CVE-2021-44228, CVE-2021-45046, CVE-2021-45105?

 Solution

AGECOM products are not affected by the vulnerabilities raised for the Apache Log4j libraries under the following CVEs: CVE-2021-44228, CVE-2021-45046, CVE-2021-45105. These relate to Log4j library versions 2.x through to 2.16. The version of Log4j used in AGECOM products is 1.2.16.

By default AGECOM products are not affected by the vulnerability raised under CVE-2021-4104. However if the default configuration has been changed and log4j appender configuration setting set to JMSAppender then a vulnerability may exist. To ensure the AGECOM products retain their default configuration and are not vulnerable check the log4j.properties file under the 'Export' or 'AGECOM' folders located under the Data directory on your Notes client or Domino server.

The default appender used by the AGECOM products is 'ConsoleAppender'. The following lines should appear in the log4j.properties file:
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%C.%M(%F:%L) %p: %m%n

All other appender lines should either be commented out or removed. There should not be any lines which relate to JMSAppender.



© 2022 AGE Computer Consultancy. All rights reserved.
Material may not be reproduced or distributed in any form without permission.