LOG4J Vulnerability Impact on Axiros Products and Services
This document provides information about Axiros’ products exposure to the recent Log4j vulnerability https://nvd.nist.gov/vuln/detail/CVE-2021-44228.
Axiros is currently investigating if this vulnerability could be relevant in systems using Axiros’ products. We will provide technical conclusions as soon as possible and update this document as new information emerges.
Version Information
1.0 2021-12-13 public document release
Overview by product or service
Details
AXESS ACS
AXESS ACS versions below 4.0 do not use Java based components. In particular they do not include log4j and are not affected.AXESS ACS in version 4.0 (AXESS4) contains ElasticSearch in version 7.15 which is affected by the vulnerability. It can be mitigated by restarting Elastic with the JVM option -Dlog4j2.formatMsgNoLookups=true
AXTRACT
Axtract uses Kafka which leverages log4j v1.2.x which is not affected.
Axtract uses Zookeeper which leverages log4j 1.2x which is not affected.
AXWIFI
AXWIFI leverages ELK 6.5.4 which includes log4j version 2.11.
The issue can be mitigated by starting the JVM with option -Dlog4j2.formatMsgNoLookups=true
DHCP and AX DOCSIS
AX DHCP and AX DOCSIS are affected if used in combination with ELK v7.5.2 which uses log4j v2.11.1. In this case, ELK must be updated to the latest available version.
AX69
Axiros hosted device management solution AX69 has been updated to solve log4j related issues.
Contact
For further questions on the impact of log4j vulnerability on Axiros’ products, please contact [email protected].
If you have issues or questions on your specific installation, please contact [email protected].