CVE-2021-44228 log4j impact regarding InfluxData products

[darinfisher]

CVE-2021-44228 log4j impact regarding InfluxData products

The log4j Java library is not included or utilized by any of the InfluxData products and has minimal use within operations. All use has been mitigated based on current recommended best practices.

This includes all versions of:

• InfluxDB OSS
• InfluxDB Enterprise
• InfluxDB Cloud
• Telegraf
• Kapacitor
• Chronograf

[rickspencer3]

Please note that the engineering team treated this as very high priority, and ruled out that we were using the affected library in publicly available projects. We believe that the following projects are wholly unaffected:

• InfluxDB Cloud
• InfluxDB Open Source (1.x and 2.x)
• InfluxDB Enterprise
• Telegraf
• Kapacitor

There were some places where our internal tooling used the impacted library. These places were not particularly vulnerable, as they were not accessible to the public internet. Nonetheless, they were either patched or the issue mitigated immediately.

I believe that there are currently no signs that this exploit has impacted InfluxDB or InfluxData.

[jdstrand]

The https://github.com/influxdata/telegraf-operator/ project references log4j in its example elasticsearch configuration: https://github.com/influxdata/telegraf-operator/blob/master/examples/helm/values.yml#L21. While telegraf-operator is in alpha and not yet considered production ready, people using it with elasticsearch may want to use the following to ensure that the underlying helm chart has log4j configured to disable lookups:

esConfig:
  ...
esJavaOpts: -Dlog4j2.formatMsgNoLookups

See elastic/helm-charts#1463 for details. A fix planned for helm-charts 7.16.1.

[timhallinflux]

Our official blog post is here.

[jdstrand]

Another issue, CVE-2021-45046, was discovered in log4j 2. Like CVE-2021-44228, this only affected internal tooling which has either been patched or the issue was mitigated.

[timhallinflux]

Shall I just have the blog post updated to cover both CVEs?

[jdstrand]

Yes. The language in the blog post applies equally to CVE-2021-45046.

[timhallinflux]

working it now!

[timhallinflux]

done. blog update rolling out shortly.