Apache Log4j vulnerability (urgent!!!!)Hi,
I just got this message from a large customer of ours asking if JMP uses Apache Log4. Does anyone know the answer?:
"We are contacting you with urgency regarding to the recently discovered critical vulnerability affecting Apache Log4j which is a logging package for Java. All IT Systems using this package must be updated asap to close the vulnerability.
The critical vulnerability allows remote code execution, and some background information can be found here : A Vulnerability in Apache Log4j Could Allow for Arbitrary Code Execution (cisecurity.org)
We need your collaboration to track and remediate this vulnerability. Can you please check and confirm to us that JMP is not using this logging library?"
Re: Apache Log4j vulnerability (urgent!!!!)Here's the external bulletin from SAS. It mentions that JMP is not affected by the vulnerability.
Re: Apache Log4j vulnerability (urgent!!!!)Hi Ryan,
Thank you for the very fast reply. This is exactly what I was hoping to hear.
Hadley
Re: Apache Log4j vulnerability (urgent!!!!)@Duane_Hayes is coordinating a JMP Note to explain our situation completely. We'll add a link to that note here and in the announcements on jmp.com and community.jmp.com.
Re: Apache Log4j vulnerability (urgent!!!!)It looks like JMP Genomics and JMP Clinical are impacted because of SAS 9.4. Remote Code Execution Vulnerability (CVE-2021-44228) | SAS Support was updated recently. Tech support is aware.
Re: Apache Log4j vulnerability (urgent!!!!)Hi everyone,
Back to this again, unfortunately. Someone wrote me asking about the log4j.jar file within the JMP folder:
They're asking if they can simply delete the file, or is it required? I'm wondering the same thing myself, or if having the file exposes us to the vulnerability.
What should I advise?
Re: Apache Log4j vulnerability (urgent!!!!)Really short answer, and the one you should give: Please refer customers with questions like this to Technical Support, support@jmp.com. Save your relationship and knowledge for helping with their business problems and JMP adoption. Let Technical support handle this.
Short answer: If they are not using the SAS integration, yes they can delete it.
Longer answer: If they are using the SAS integration they can't delete it but there is no vulnerability with leaving it in place because the JRE that JMP uses disables the messaging options that cause the vulnerability.
