• State Suggested Answer
  • Replies replies
    7
  • Answers answer
    1
  • Subscribers subscribers
    23
  • Views views
    1262
  • Users 0 members are here
  • +3 person also asked this people also asked this
Related Discussions
Options

Fortify Software Security Center & CVE-2021-44228

Fred Jonkhart

Fortify SSC v20.* is vunerable with respect to CVE-2021-44228.

Any experience using the Log4J settings work around? 

Parents
  • 0

    In my client enviroment I've (stopped tomcat service and) replaced 

    on SSC
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\birtrunner\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\birtrunner\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\birtrunner\log4j-slf4j-impl-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\iidmigrator\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\iidmigrator\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\runtime-bridge\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\runtime-bridge\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-jul-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-slf4j-impl-2.14.1.jar

    on ScanCentral SAST controller
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-1.2-api-2.14.1.jar
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-jcl-2.14.1.jar

    to the proper log4j-*-2.15.0.jar files extracted from latest Log4j version downloaded from logging.apache.org/.../download.html

    Can Microfocus confirm that this mitigation resolves CVE-2021-44228 vulnerability??

    thanks 

    -- 
    Pawel

Reply
  • 0

    In my client enviroment I've (stopped tomcat service and) replaced 

    on SSC
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\birtrunner\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\birtrunner\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\birtrunner\log4j-slf4j-impl-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\iidmigrator\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\iidmigrator\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\runtime-bridge\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\externallib\runtime-bridge\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-jul-2.14.1.jar
    apps\Tomcat\webapps\ssc\WEB-INF\lib\log4j-slf4j-impl-2.14.1.jar

    on ScanCentral SAST controller
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-1.2-api-2.14.1.jar
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-api-2.14.1.jar
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-core-2.14.1.jar
    apps\Tomcat\webapps\scancentral-ctrl\WEB-INF\lib\log4j-jcl-2.14.1.jar

    to the proper log4j-*-2.15.0.jar files extracted from latest Log4j version downloaded from logging.apache.org/.../download.html

    Can Microfocus confirm that this mitigation resolves CVE-2021-44228 vulnerability??

    thanks 

    -- 
    Pawel

Children

Resources

Support
Documentation
Training
CyberRes Academy
Partner Portal
Contact us
Compliance
Help
Company
Privacy Policy
Terms of Use
Accessibility
Anti-Slavery Statement
Support
How To Buy
Careers
Investor Relations
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.