Splunk enterprise Logback 1.2.3 CVE-2021-42550

[qessar]

In Splunk enterprise when running the following log4j scanner it is picking up that the following files

as vulnerable. Can somebody please provide steps on how I can remediate this? Is it a case of upgrading

all splunk servers with the latest version from https://logback.qos.ch/download.html. If not please advise steps and will it require me to reboot all related splunk servers please?

log4j/logback scanner

https://github.com/logpresso/CVE-2021-44228-Scanner

Files found as being vulnerable

C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\jars\command.jar

Logback 1.2.3 CVE-2021-42550
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\jars\dbxquery.jar Logback 1.2.3 CVE-2021-42550
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\jars\server.jar Logback 1.2.3 CVE-2021-42550

many thanks

[richgalloway]

Have you seen https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228... ?

[qessar]

thanks for your reply.

Unfortunately that does not cover logback CVE-2021-42550.

Logback is a fork of logj4 - whilst everybody is concentrating on log4j they are missing or simply ignoring logback. 

I just need to know the remediation steps, patched to upgrade logback 1.2.3 which is being used by Splunk Enterprise 8.0.3.0. thank you