Optimizely
How SearchStax is Handling CVE-2021-44228 / Log4j Flaw Vulnerability for Solr
Dec. 12, 2021
Dipsy Kapoor
|
CVE-2021-44228 was initially announced on Github Advisory on December 10, 2021, as a Critical Vulnerability affected Log4j versions prior to 2.15.0. Log4j versions prior to 2.15.0 are subject to a remote code execution vulnerability via the LDAP JNDI parser.
Solr Security website reports that Solr versions 7.4.0 to 7.7.3, 8.0.0 to 8.11.0 are affected by the Log4j Flaw Vulnerability.
Critical Security Update
During the initial analysis by Github Advisory and NVD, it was stated that “Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting “com.sun.jndi.rmi.object.trustURLCodebase” and “com.sun.jndi.cosnaming.object.trustURLCodebase” to “false””
As of December 12, 2021, the above mitigation advice has been removed from both Github Advisory and the NVD website. SearchStax team is treating this as a Critical Security Update and is going ahead with applying the mitigation advice of adding SOLR_OPTS=”$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true” to the startup scripts for all its deployments.
Update: December 12, 2021, 7:20pm PT
As of December 12, 2021 7:20 pm US Pacific time, all Solr deployments 7.4.0 and above have been patched by the SearchStax team. Other Solr versions have not been affected by CVE-2021-44228 as mentioned in the Solr Security website
Update: December 20, 2021, 11:40pm PT
Solr Security Site has been updated and confirms that Solr is not vulnerable to CVE-2021-45046 and CVE-2021-45105
“Apache Solr releases are not vulnerable to the followup CVE-2021-45046 and CVE-2021-45105, because the MDC patterns used by Solr are for the collection, shard, replica, core and node names, and a potential trace id, which are all sanitized and injected into log files with “%X“. Passing system property log4j2.formatMsgNoLookups=true (as described below) is suitable to mitigate.”
log4j2.formatMsgNoLookups=true Update: February 7, 2022
SearchStax now offers Solr 8.11.1 which does not have this vulnerability.
If you have any questions, please reach out to support@site-dev.searchstax.com
Dipsy brings over a decade of large scale search, data alignment, integration, and machine learning experience in building cloud-based software applications. Prior to joining SearchStax, Dipsy worked with both federal and commercial organizations delivering high-value results using big data and machine learning technologies in cloud environments. Dipsy earned her M.S. in Computer Science from the University of Southern California.