10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%
IBM products for Cloudera Data Platform and Hortonworks Data Platform are affected by critical Apache Log4j vulnerability (CVE-2021-44228). A malicious user could exploit this vulnerability to run arbitrary code as the user or service account running the affected software. The fix includes Apache Log4j v2.16.
CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Affected IBM Product(s) | Version(s) |
---|---|
Hortonworks Data Platform (HDP) with IBM | 3.0, 3.0.1 |
Cloudera Data Platform (CDP) with IBM
Customers are encouraged to act swiftly to resolve this issue.
Apply hotfix
Download all files from this repo: <https://github.com/cloudera/cloudera-scripts-for-log4j>
Run the following script on all affected cluster nodes.
NOTE: After applying the Short Term Resolution, if you add a node, you will need to re-apply the Short Term Resolution again on the new nodes.
Script: run_log4j_patcher.sh [cdp|cdh|hdp]
Function: The run_log4j_patcher.sh script scans a directory for jar files and removes JndiLookup.class from the ones it finds. Do not run any other script in the downloaded directory–they will be called by run_log4j_patcher.sh automatically.
Usage: $PROG (subcommand) [options]
Subcommands:
Options (cdh and cdp subcommands only):
-t <targetdir> Override target directory (default: distro-specific)
-b <backupdir> Override backup directory (default: /opt/cloudera/log4shell-backup)
Environment Variables (cdh and cdp subcommands only):
The SKIP_* environment variables should only be used if you are running the script again and want to skip phases that have already completed.
SKIP_JAR If non-empty, skips scanning and patching .jar files
SKIP_TGZ If non-empty, skips scanning and patching .tar.gz files
SKIP_HDFS* If non-empty, skips scanning and patching .tar.gz files in HDFS
RUN_SCAN If non-empty, runs a final scan for missed vulnerable files.
This can take several hours.
NOTE: CDH/CDP Parcels: The script removes the affected class from all CDH/CDP parcels already installed under /opt/cloudera. This script needs to be re-run after new parcels are installed or after upgrading to versions of CDH/CDP that do not include the long-term fix.
Removing affected classes from Oozie Shared Libraries (CDH & CDP)
The vulnerability affects client libraries uploaded in HDFS by Cloudera Manager. The script takes care of Tez and MapReduce libraries however Oozie libraries will need to be updated manually. The following section only applies to Cloudera Data Hub and Cloudera Data Platform releases.
Follow the instructions below to secure the Oozie shared libraries:
1. Execute the run_log4j_patcher.sh on the affected cluster.
2. Navigate to Cloudera Manager > Oozie > Actions -> “Install Oozie ShareLib” to re-upload the Oozie libraries in the HDFS from Cloudera Manager.
IMPORTANT: Ensure that the Oozie service is running prior to executing the command.
Removing affected classes from Oozie Shared Libraries (HDP)
Run these commands to update Oozie share lib:
su oozie
kinit oozie /usr/hdp/current/oozie-server/bin/oozie-setup.sh sharelib
create -fs hdfs://ns1
oozie admin -oozie http(s)://<oozie-host/loadbalancer>:11(000|443)/oozie
-sharelibupdate
For the latest updates from Cloudera, refer to Resolution for TSB-545 - Private Cloud.
Known Limitations: Cloudera Data Hub clusters using packages rather than parcels are not yet supported with this fix.
None
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
100.0%