topic Re: log4j vulnerable files are getting recreated after removal(CVE-2021-44228. ) in Splunk Enterprise

log4j vulnerable files are getting recreated after removal(CVE-2021-44228. )

imsidrai — Mon, 20 Dec 2021 18:14:52 GMT

we followed the steps provided on https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html but it seems that files are being recreated , Can anyone please help on that ??,
Also i wanted to know if replacing just Apache version rather upgrading splunk could help to mitigate ?
and what should be the steps if i replace?

Re: log4j vulnerable files are getting recreated after removal(CVE-2021-44228. )

richgalloway — Mon, 20 Dec 2021 18:45:00 GMT

Which files are you talking about? Are they actually being recreated or is the deletion failing? Are the files showing up in the splunk_archiver app? If so, the blog says what to do about that.

Re: log4j vulnerable files are getting recreated after removal(CVE-2021-44228. )

japonter — Wed, 29 Dec 2021 21:34:08 GMT

did you just delete the 4 paths the documents say. i have been looking for more clarification into this. as i read it just indicates to delete those 4 paths and that should be it. is this true?