Development/Security/Log4j-2021-12 - Revision history

Dan: Update changelog

2021-12-17T14:34:04Z

Update changelog

2021-12-16T09:33:58Z

Link to am wiki

2021-12-15T17:08:45Z

Add changelog

2021-12-15T17:06:55Z

‎Archivematica: Update AM instructions to include recommendation to upgrade ES first

2021-12-14T20:29:40Z

Update change log at top

2021-12-14T20:28:54Z

‎What is the recommended fix for this vulnerability?: Add a new section on why this fix

2021-12-14T20:18:30Z

‎Where can I get more technical information for my IT team?: minor grammatical fix

2021-12-14T20:18:07Z

‎Where can I get more technical information for my IT team?: Add another source link

2021-12-14T20:16:22Z

‎Archivematica: minor clarification in instructions

2021-12-13T22:07:14Z

‎Atom: Fix minor formatting typo

@@ Line 3: / Line 3: @@
 * Posted: 2021-12-13
-* Last updated: 2021-12-15
+* Last updated: 2021-12-17
 '''Change log'''
@@ Line 10: / Line 10: @@
 * 2021-12-14 - Add clarifications and explanation why AM and AtoM solutions are different
 * 2021-12-15 - Add change log; Update AM instructions to include recommendation to upgrade ES first
 -----

@@ Line 99: / Line 99: @@
 ===Archivematica===
-* First, upgrade to the latest version of Elasticsearch v6.x
+Please follow the instructions on the [https://wiki.archivematica.org/Log4j Archivematica wiki]
 ===Atom===

@@ Line 3: / Line 3: @@
 * Posted: 2021-12-13
-* Last updated: 2021-12-14 (add clarifications and explanation why AM and AtoM solutions are different)
+* Last updated: 2021-12-15
 Below is the latest information and recommendations we have about [https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228 CVE-2021-44228], colloquially called the "Log4Shell" vulnerability found in Apache Log4j in December of 2021.

@@ Line 91: / Line 91: @@
 ===Archivematica===
-Please follow the instructions on Step 4 on this guide:
+* First, upgrade to the latest version of Elasticsearch v6.x
 * https://www.geekyhacker.com/2021/12/11/three-ways-to-patch-log4shell-cve-2021-44228-vulnerability/
@@ Line 97: / Line 99: @@
 In short, as root:
-* Edit <code>/etc/default/elasticsearch</code> (Debian/Ubuntu) or <code>/etc/sysconfig/elasticsearch</code> (RedHat/CentOS). Add <code>-Dlog4j2.formatMsgNoLookups=True</code> to the ES_JAVA_OPTS line, for example:
+* Edit <code>/etc/default/elasticsearch</code> (Debian/Ubuntu) or <code>/etc/sysconfig/elasticsearch</code> (RedHat/CentOS) and find the  line with your ES_JAVA_OPTS, and append this option to the end of it:
   ES_JAVA_OPTS="-Xms2g -Xmx2g -Dlog4j2.formatMsgNoLookups=True"

@@ Line 3: / Line 3: @@
 * Posted: 2021-12-13
-* Last updated: 2021-12-13
+* Last updated: 2021-12-14 (add clarifications and explanation why AM and AtoM solutions are different)
 Below is the latest information and recommendations we have about [https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228 CVE-2021-44228], colloquially called the "Log4Shell" vulnerability found in Apache Log4j in December of 2021.

← Older revision		Revision as of 20:28, 14 December 2021
Line 118:		Line 118:

	* Restart the ElasticSearch service with: <code>service elasticsearch restart</code>		* Restart the ElasticSearch service with: <code>service elasticsearch restart</code>
		+
		+	==Why are the recommended fixes different for AtoM and Archivematica?==
		+
		+	The most important distinction is that AtoM is using Elasticsearch 5.x, while Archivematica is using Elasticsearch 6.x.
		+
		+	The ES_JAVA_OPTS variable solution recommended for Archivematica will '''only''' work Log4j releases later than 2.10, which will always be the case with Elasticsearch 6 installations.
		+
		+	Meanwhile, with Elasticsearch 5, and the fact that AtoM 2.6 has been out for some time, this is not a guarantee - older ES 5.x installations may include a Log4j version earlier than 2.10 - in which case, the ES_JAVA_OPTS solution will not take effect. By proposing the zip deletion solution, we are offering a method that should work for all 2.x versions of Log4j, and which is much easier than trying to upgrade Log4j in place without disrupting your AtoM installation.
		+
		+	Our team found the following article very helpful in better understanding the options and pros and cons of each:
		+
		+	* https://www.geekyhacker.com/2021/12/11/three-ways-to-patch-log4shell-cve-2021-44228-vulnerability/

	==Where can I get more technical information for my IT team?==		==Where can I get more technical information for my IT team?==

@@ Line 129: / Line 129: @@
 * https://www.geekyhacker.com/2021/12/11/three-ways-to-patch-log4shell-cve-2021-44228-vulnerability/
-Some sources we have found to be reliable and regularly updated:
+Some other sources we have found to be reliable and regularly updated:
 * Elastic [https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476 security announcement on CVE-2021-44228], December 10, 2021

← Older revision		Revision as of 20:18, 14 December 2021
Line 124:		Line 124:

	(Learn more about what a CVE is [https://www.cve.org/About/Overview here] and [https://www.cve.org/About/History here])		(Learn more about what a CVE is [https://www.cve.org/About/Overview here] and [https://www.cve.org/About/History here])
		+
		+	Our team found this document very helpful for outlining some of the different options for addressing the vulnerability:
		+
		+	* https://www.geekyhacker.com/2021/12/11/three-ways-to-patch-log4shell-cve-2021-44228-vulnerability/

	Some sources we have found to be reliable and regularly updated:		Some sources we have found to be reliable and regularly updated:

@@ Line 105: / Line 105: @@
 ===Atom===
- Please follow the instructions on Step 5 of this guide:
+Please follow the instructions on Step 5 of this guide:
 * https://www.geekyhacker.com/2021/12/11/three-ways-to-patch-log4shell-cve-2021-44228-vulnerability/