ArcGIS Trust Center

ArcGIS Enterprise Log4j Security Patches Available

Last updated: 9/1/2022

Critical security vulnerabilities in Apache Log4j may allow escalation of privilege or denial of service. Apache Log4j is used across ArcGIS Enterprise components, therefore Esri has released separate updates for ArcGIS Server, Portal for ArcGIS, and ArcGIS Data Store to resolve these vulnerabilities.

Esri initially released scripts to quickly mitigate the critical Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. The software patches described below remediate these vulnerabilities as well as other Log4j vulnerabilities listed in this announcement.

ArcGIS Enterprise 11.0

Does not require Log4j patching and is therefore the ideal remediation – For additional information see the cross-product Log4j announcement.

ArcGIS Enterprise Patches:

See ArcGIS Enterprise Log4j Patch Summary Page

 

Patch Details:

  

Log4j vulnerabilities addressed in these patches include:

CVEID: CVE-2021-44228 (Non-Esri issued 12/9/2021)

Description: JNDI features in Apache Log4j2 may allow an authenticated user to potentially enable escalation of privilege via network access.

CVSS Base Score: 10.0 Critical

CVSS Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2021-45046 (Non-Esri issued 12/14/2021)

Description: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

CVSS Base Score: 9.0 Critical

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE- 2021-4104 (Non-Esri issued 12/14/2021)

Description: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.

CVSS Base Score: 7.5 HIGH

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2021-45105 (Non-Esri issued 12/18/2021)

Description: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVSS Base Score: 5.9 MEDIUM

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2021-44832 (Non-Esri issued 12/28/2021)

Description: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server.

CVSS Base Score: 6.6 MEDIUM

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2022-23305 (Non-Esri issued 1/18/2022)

Description: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

CVEID: CVE-2022-23302 (Non-Esri issued 1/18/2022)

Description: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to.

CVSS Base Score: 8.8 HIGH

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2022-23307 (Non-Esri issued 1/18/2022)

Description: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2020-9488 (Non-Esri issued 4/27/2020)

Description:  Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

CVSS Base Score: 3.7 LOW

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2019-17571 (Non-Esri issued 12/20/2019)

Description: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

CVEID: CVE-2017-5645 (Non-Esri issued 4/17/2017)

Description: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

 

Cross-Product Guidance:

Due to the level of concern with Log4j vulnerabilities across industries, Esri provides cross-product guidance for Log4j concerns as a separate announcement here.

 

Acknowledgements:

These issues were found externally and were publicly disclosed via the National Vulnerability Database.

 

Next Article

Weather Operational Effects Solution Released

Read this article