Optimizely
CVE-2021-44228 was initially announced on Github Advisory on December 10, 2021, as a Critical Vulnerability affecting Log4j versions prior to 2.15.0. Log4j versions prior to 2.15.0 are subject to a remote code execution vulnerability via the LDAP JNDI parser.
Solr Security website reports that Solr versions 7.4.0 to 7.7.3, 8.0.0 to 8.11.0 are affected by the Log4j Flaw Vulnerability.
Critical Security Update
During the initial analysis by Github Advisory and NVD, it was stated that “Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting “com.sun.jndi.rmi.object.trustURLCodebase” and “com.sun.jndi.cosnaming.object.trustURLCodebase” to “false””
As of December 12, 2021, the above mitigation advice has been removed from both Github Advisory and the NVD website. SearchStax team is treating this as a Critical Security Update and is going ahead with applying the mitigation advice of adding SOLR_OPTS=”$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true” to the startup scripts for all its deployments.
Update: December 12, 2021, 7:20pm PT
As of December 12, 2021 7:20 pm US Pacific time, all Solr deployments 7.4.0 and above have been patched by the SearchStax team. Other Solr versions have not been affected by CVE-2021-44228 as mentioned in the Solr Security website.
Update: December 20, 2021, 11:40pm PT
Solr Security Site has been updated and confirms that Solr is not vulnerable to CVE-2021-45046 and CVE-2021-45105.
“Apache Solr releases are not vulnerable to the followup CVE-2021-45046 and CVE-2021-45105, because the MDC patterns used by Solr are for the collection, shard, replica, core and node names, and a potential trace id, which are all sanitized and injected into log files with “%X“. Passing system property log4j2.formatMsgNoLookups=true (as described below) is suitable to mitigate.”
SearchStax deployments do NOT use JMSAppender and all deployments with Solr versions above 7.4.0 have been patched to include log4j2.formatMsgNoLookups=true
Update: February 7, 2022
SearchStax now offers Solr 8.11.1 which does not have this vulnerability.
If you have any questions, please reach out to support@searchstax.com
Get Our Newsletter
The Stack is delivered bi-monthly with industry trends, insights, products and more
Engineering leader building cloud-native search products at SearchStax, focused on scalable systems, search relevance, performance, and delivering outcomes that matter for customers.
