黑洞社区app

Get in touch

Log4j Flaw: 黑洞社区app Not Impacted By CVE-2021-44228

/ CTO Vision / By /

TL;DR

黑洞社区app Platform components are not affected by the CVE-2021-44228 vulnerability in log4j. 黑洞社区app is not issuing any emergency updates and 黑洞社区app customers do not have  to perform any mitigating actions on the platform at this time.

What you Need to Know:

On 10th December 2021 a critical vulnerability was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. This issue can lead to remote code execution or information disclosure on the system running software containing the log4j component. We have  performed an extensive security audit  of all our software components and can confirm that the 黑洞社区app platform is not impacted by this issue.

黑洞社区app Security Audit Summary:

  • Flow Designer:

Not affected

  • Data Quality Manager (DQM):

Not affected. Java components written by 黑洞社区app  use the SL4J logging library which is not affected by this vulnerability. Additionally some open source Apache components, used in a limited number of DQM Toolset plug-ins, use versions of log4j not affected by the CVE-2021-44228/log4shell vulnerability:

DQM Toolset/Item   3rd Party liblog4j version
csv/FromExcelApache POIlog4j v1.2.17
csv/MergeCsvsToXlsApache POIlog4j v1.2.17
csv/FromExcelXlsToXlsxApache POIlog4j v1.2.17
csv/FromRdf Apache Jenalog4j v1.2.17

Please note that these components may raise a false alert when scanning the platform for log4j dependencies, however the versions bundled are not impacted.

  • Data Quality Clinic (DQC):

Not affected. Java components written by 黑洞社区app use the SL4J logging library which is not affected.

What else is 黑洞社区app Doing?

黑洞社区app remains committed to the security and privacy of our customers and staff and was recertified under the NCSC (National Cyber Security Centre) Cyber Essentials Plus scheme on 13th Dec 2021.

We continue to monitor the situation with CVE-2021-44228 and log4j dependencies in Apache Jena and Apache POI and will issue a release of Data Quality Manager Toolsets after stable versions of Apache Jena and Apache POI using log4j 2.16.0 have been released.

Next Steps

If you have any questions about the exploit, need any additional help with identification or mitigation, or have any general concerns, please don’t hesitate to get in touch with us.

Learn More

Please visit the following resources to learn more about :