[ad_1]
Abstract
On December tenth 2021, the Apache Software program Basis launched model 2.15.0 of the Log4j Java logging library, fixing CVE-2021-44228, a distant code execution vulnerability affecting Log4j 2.0-2.14. An attacker can use this vulnerability to instruct affected methods to obtain and execute a malicious payload by means of submitting a custom-crafted request. This vulnerability is crucial and is rated 10 out of 10 on the CVSS 3.1 scoring scale.
How is Cloudera responding to this vulnerability?
Software program and companies throughout our trade and open supply communities use Log4j for dealing with log messages. Cloudera’s safety and engineering groups have recognized the influence of this CVE throughout our product suite, and Cloudera prospects have been despatched detailed updates by means of Cloudera’s Technical Help Bulletins (TSB) and My Cloudera assist instances.
What Cloudera merchandise and variations are affected?
A number of Cloudera merchandise and open supply tasks use Log4j to course of log messages. The Cloudera assist staff has supplied the record of impacted merchandise and variations to our Cloudera prospects by means of an in depth TSB. If you’re not an present Cloudera buyer, please go right here.
What do Cloudera prospects must do to mitigate this CVE?
We encourage prospects to overview the main points in our TSB and apply workarounds instantly. On the identical time, prospects ought to plan to improve to soon-to-be-released variations of Cloudera software program that embody fixes for this CVE.
It’s additionally essential to know that this vulnerability shouldn’t be restricted to Cloudera merchandise. This vulnerability can have an effect on underlying infrastructure software program in addition to workloads prospects run on high of Cloudera merchandise, reminiscent of Spark jobs or Flink functions. We advocate that prospects assess their total surroundings for using Log4j and remediate it as quickly as potential.
Ought to prospects anticipate a brand new Cloudera launch or use steered remediation?
The scenario is crucial, and exploits and bypasses are starting to propagate on the web. Except you understand your surroundings is absolutely protected with compensating controls, we advocate that prospects instantly handle the scenario with the proposed remediation and plan to improve to approaching software program releases.
Please create a assist case by means of My Cloudera for any additional questions or clarifications.
[ad_2]
