Apache Log4J vulnerability: JMP 16.2 or later

Question

Hi

Today I found that the information about JMP and Log4J vulnerability page was updated because we received a question about Log4J from Taiyo Yuden and checked the page.

At Taiyo Yuden, there are over 5000 JMP users and some of them connect from JMP to remote SAS server.

https://support.sas.com/en/security-bulletins/remote-code-execution-vulnerability-cve-2021-44228.html#221dd3cc-e79a-45e6-bb60-c6814622e1e4

https://www.jmp.com/support/notes/68/714.html

In the Problem Note 68714 page, there is the paragraph below and I could not understand clearly what the red part says.

JMP 16.2 should not be vulnerable to CVE-2021-45046 because the default configuration is used, but it is potentially vulnerable to CVE-2021-45105. Because JMP uses a standard implementation and runs only when initiating a connection to SAS (after which it is shut down), JMP should not be vulnerable to CVE-2021-45105.

Let me confirm: does this mean that Log4J is run only for the merest instant so a problem by the vulnerability is very unlikely to happen?

And Taiyo Yuden asked about our plan for after 16.2 version of JMP on this. Do you expect JMP 17.0 uses newer (fixed) version of Log4j ?

Your help is greatly appreciated.

Kyoko

briancorcoran · Accepted Answer

Hi Kyoko,

It means that as long as the customer does not try to add configuration information for the log4j service, JMP should not be vulnerable.

Brian

briancorcoran · Accepted Answer

Also, JMP 17 will use the newest version of log4j at the time of code freeze.  So yes, it will have a newer version.  It should also be possible for the customer to replace the 3 log4j related files manually if they want the newest version in 16.2.

Brian