Security

Splunk enterprise Logback 1.2.3 CVE-2021-42550

qessar
Observer

In Splunk enterprise when running the following log4j scanner it is picking up that the following files

as vulnerable. Can somebody please provide steps on how I can remediate this? Is it a case of upgrading

all splunk servers with the latest version from https://logback.qos.ch/download.html. If not please advise steps and will it require me to reboot all related splunk servers please?

 

log4j/logback scanner

https://github.com/logpresso/CVE-2021-44228-Scanner

 

Files found as being vulnerable

C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\jars\command.jar

Logback 1.2.3 CVE-2021-42550
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\jars\dbxquery.jar Logback 1.2.3 CVE-2021-42550
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\jars\server.jar Logback 1.2.3 CVE-2021-42550

 

many thanks

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you seen https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228... ?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

qessar
Observer

thanks for your reply.

Unfortunately that does not cover logback CVE-2021-42550.

 

Logback is a fork of logj4 - whilst everybody is concentrating on log4j they are missing or simply ignoring logback. 

 

I just need to know the remediation steps, patched to upgrade logback 1.2.3 which is being used by Splunk Enterprise 8.0.3.0. thank you

Tags (1)
0 Karma