NewsSiemens ProductCERT

SSA-714170 V1.0: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000

On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as “Log4Shell”. On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. Siemens Energy is preparing updates and recommends specific countermeasures.

CVE-2021-44228[UPDATE] Zero-Day Vulnerability in Apache Java Logging Library Log4j
CVE-2021-44228Red Hat Security Advisory: Openshift Logging security and bug update (5.3.1)
CVE-2021-44228Debian apache-log4j2: security update
CVE-2021-45046Apache Log4j: Expression-Language-Injection
CVE-2021-44228Siemens ProductCERT Advisory SSA-479842
CVE-2021-45046Debian apache-log4j2: security update
CVE-2021-44228Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
CVE-2021-45046Incomplete fix for Apache Log4j vulnerability
CVE-2021-44228Red Hat Security Advisory: Openshift Logging security and bug update (5.2.4)
CVE-2021-44228Red Hat Security Advisory: Openshift Logging security and bug update (5.1.5)
CVE-2021-44228Siemens ProductCERT Advisory SSA-714170
CVE-2021-44228Apache Log4j2: Deserialisierung nicht vertrauenswürdiger Daten
CVE-2021-45046Apache Log4j2 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability
CVE-2021-44228Apache Log4j2 — Apache Log4j2 Remote Code Execution Vulnerability
CVE-2021-44228[Update] Immediate Actions to Protect Against Exploitation of the Apache Java Logging Library Log4j Vulnerability
CVE-2021-44228Remote code injection in Log4j
CVE-2021-44228Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update
CVE-2021-44228Siemens ProductCERT Advisory SSA-661247
CVE-2021-44228Siemens ProductCERT Advisory SSA-397453
CVE-2021-44228Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update

Affected vendors and products

Apache Software Foundation Apache Log4j Core
Apache Software Foundation Apache Log4j
Apache Software Foundation Apache Log4j2
Apple Apple Xcode
Bentley
Cisco Business Process Automation
Cisco Cisco Common Services Platform Collector Software
Cisco Cisco Connected Mobile Experiences 10.2(1.0)
Cisco Cisco Crosswork Network Change Automation
Cisco Cisco CX Cloud Agent
Cisco Cisco Cyber Vision
Cisco Cisco Data Center Network Manager

Other advisories

CriticalCVE-2021-44228Siemens ProductCERT Advisory SSA-714170

Source: https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf

Linked advisories

Affected vendors and products

More on SSA-714170

Other advisories