Questions about the CVE-2021-44228 vulnerability

Hello All, I have a question about a vulnerability related to Log4j. The document below is an update on the vulnerabilities of Log4j-related classes. https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log4j-cve-2021-44228-vulnerability/ The files informixhq-agent.jar and informixhq-server.jar contain the Log4j class. How can I check if this class is the version where the vulnerability exists? Thanks, SangGyu Jeong ------------------------------ SangGyu Jeong Software Engineer Infrasoft Seoul Korea, Republic of ------------------------------ #Informix

I would say, I would not use informixhq with the latest Informix Server versions.. Cheers, Markus ------------------------------ Markus Holzbauer ------------------------------

You can verify if your Version is affected with: $ cd $INFORMIXDIR/hq $ unzip -l informixhq-agent.jar|grep log4j/core/lookup/JndiLookup.class >/dev/null 2>&1 && echo "fix needed" Cheers,Markus ------------------------------ Markus Holzbauer ------------------------------

The recommendation I got from IBM via a PMR was not to use HQ until the dev team have investigated further Cheers Paul Paul Watson Oninit LLC +1-913-387-7529 www.oninit.com Oninit® is a registered trademark of Oninit LLC

Thanks for the information, Paul. ------------------------------ SangGyu Jeong Software Engineer Infrasoft Seoul Korea, Republic of ------------------------------

I have notified development about this. Scott Pickett IBM Informix WW Technical Sales IBM Expert Labs IBM Informix WW Cloud Technical Sales IBM Expert Labs IBM Informix WW Cloud Technical Sales ICIAE IBM Expert Labs IBM Informix WW Informix Warehouse Accelerator Sales IBM Expert Labs Boston, Massachusetts USA spickett@us.ibm.com 617-899-7549 33 Years Informix User The current Informix Roadshow presentations are here: https://community.ibm.com/community/user/hybriddatamanagement/viewdocument/informix-1410xc2-features?CommunityKey=cf5a1f39-c21f-4bc4-9ec2-7ca108f0a365&tab=librarydocuments All presentations and the agenda used by the Roadshow can be found there. Website for Internet Of Things https://www.ibm.com/internet-of-things/ Website for Informix https://www.ibm.com/analytics/us/en/technology/informix/

What about OAT – can we still use that? We are still on 11.70 here (with extended support). -- Thanks, Kate Tomchik She/Her/Hers Principal Systems Engineer, Database Solutions The Home Depot Cell: 678-427-4914 (Text preferred) Strange, isn't it? Each man's life touches so many other lives. When he isn't around, he leaves an awful hole, doesn't he? – It's a Wonderful Life For non-urgent requests create a TICKET: https://servicecatalog.apps.homedepot.com/home/catalog/Databases/databasesupport Choose experience: IT-08034-Database Solutions Operations INTERNAL USE

I did the equivalent of what Markus suggested over the weekend on 14.10.FC6 and proved its HQ does contain the vulnerable log4j version 2. All IDS versions before that used logback in HQ which is unaffected. ------------------------------ Doug Lawry Oninit Consulting ------------------------------

There will be a statement forthcoming in the next days as to what we will be doing here. The lab has spent the last 3.5 days on this identifying possible vulnerabilities and a fix will be forthcoming. Stay tuned. Scott Pickett IBM Informix WW Technical Sales IBM Expert Labs IBM Informix WW Cloud Technical Sales IBM Expert Labs IBM Informix WW Cloud Technical Sales ICIAE IBM Expert Labs IBM Informix WW Informix Warehouse Accelerator Sales IBM Expert Labs Boston, Massachusetts USA spickett@us.ibm.com 617-899-7549 33 Years Informix User The current Informix Roadshow presentations are here: https://community.ibm.com/community/user/hybriddatamanagement/viewdocument/informix-1410xc2-features?CommunityKey=cf5a1f39-c21f-4bc4-9ec2-7ca108f0a365&tab=librarydocuments All presentations and the agenda used by the Roadshow can be found there. Website for Internet Of Things https://www.ibm.com/internet-of-things/ Website for Informix https://www.ibm.com/analytics/us/en/technology/informix/

OAT, afair, was PHP based, so no Java anyway. Anyone able to confirm? ------------------------------ Andreas Legner ------------------------------

Hi. I guess it should be OK to run HQ if the server is behind a firewall and thus exposed to the Internet? Regards, -Snorri ------------------------------ Snorri Bergmann ------------------------------

OAT did not contain any Java so it is unaffected. ------------------------------ Brian Hughes ------------------------------

Problem with OAT is that it is Flash based, and unless you install an older version of your browser, it wont be useful (or it would be partially useful). Ramon ------------------------------ Ramon Rey ------------------------------

Depends on your internal security rules, I know of two companies that have turned off HQ on systems that are not exposed to the internet. I suspect if a company is breached by ANOther method and then use this vulnerability to gain further access then heads would roll Cheers Paul

Shouldn't we be more worried about the JDBC driver rather than HQ ? Cheers Paul

I can recommend https://github.com/mergebase/log4j-detector We scanned jdbc PS C:\\SVN> java -jar .\\log4j-detector-2021.12.12.jar .\\jdbc-4.50.4.1.jar -- Analyzing paths (could take a long time). -- Note: specify the '--verbose' flag to have every file examined printed to STDERR. -- No Log4J 2.x samples found in supplied paths: [.\\jdbc-4.50.4.1.jar] -- Congratulations, the supplied paths are not vulnerable to CVE-2021-44228 ! :-) PS C:\\SVN> java -jar .\\log4j-detector-2021.12.12.jar .\\DriverInformix.jar -- Analyzing paths (could take a long time). -- Note: specify the '--verbose' flag to have every file examined printed to STDERR. -- No Log4J 2.x samples found in supplied paths: [.\\DriverInformix.jar] -- Congratulations, the supplied paths are not vulnerable to CVE-2021-44228 ! :-) ------------------------------ Marc Demhartner ------------------------------