nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Apache Log4j vulnerability (urgent!!!!)

HadleyMyers

Hi,

I just got this message from a large customer of ours asking if JMP uses Apache Log4. Does anyone know the answer?:

"We are contacting you with urgency regarding to the recently discovered critical vulnerability affecting Apache Log4j which is a logging package for Java. All IT Systems using this package must be updated asap to close the vulnerability.

The critical vulnerability allows remote code execution, and some background information can be found here : A Vulnerability in Apache Log4j Could Allow for Arbitrary Code Execution (cisecurity.org)

We need your collaboration to track and remediate this vulnerability. Can you please check and confirm to us that JMP is not using this logging library?"

Accepted answers

Ryan_Gilmore

Here's the external bulletin from SAS. It mentions that JMP is not affected by the vulnerability.

Jeff_Perkinson

Really short answer, and the one you should give: Please refer customers with questions like this to Technical Support, support@jmp.com. Save your relationship and knowledge for helping with their business problems and JMP adoption. Let Technical support handle this.

Short answer: If they are not using the SAS integration, yes they can delete it.

Longer answer: If they are using the SAS integration they can't delete it but there is no vulnerability with leaving it in place because the JRE that JMP uses disables the messaging options that cause the vulnerability.

All comments

Ryan_Gilmore

Here's the external bulletin from SAS. It mentions that JMP is not affected by the vulnerability.

HadleyMyers

Hi Ryan,

Thank you for the very fast reply. This is exactly what I was hoping to hear.

Hadley

Jeff_Perkinson

@Duane_Hayes is coordinating a JMP Note to explain our situation completely. We'll add a link to that note here and in the announcements on jmp.com and community.jmp.com.

Chris_Kirchberg

It looks like JMP Genomics and JMP Clinical are impacted because of SAS 9.4. Remote Code Execution Vulnerability (CVE-2021-44228) | SAS Support was updated recently. Tech support is aware.

HadleyMyers

Hi everyone,

Back to this again, unfortunately. Someone wrote me asking about the log4j.jar file within the JMP folder:

They're asking if they can simply delete the file, or is it required? I'm wondering the same thing myself, or if having the file exposes us to the vulnerability.

What should I advise?

Jeff_Perkinson

Short answer: If they are not using the SAS integration, yes they can delete it.