ArcGIS Enterprise Log4j Security Patches Available

Last updated: 5/25/2023

Critical security vulnerabilities in Apache Log4j may allow escalation of privilege or denial of service. Apache Log4j is used across ArcGIS Enterprise components, therefore Esri has released separate updates for ArcGIS Server, Portal for ArcGIS, and ArcGIS Data Store to resolve these vulnerabilities.

Esri initially released scripts to quickly mitigate the critical Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. The software patches described below remediate these vulnerabilities as well as other Log4j vulnerabilities listed in this announcement.

ArcGIS Enterprise 11.1

Does not require Log4j patching or any special configuration constraints and is therefore the ideal remediation – For additional information see the cross-product Log4j announcement.

ArcGIS Enterprise Patches:`

• Portal for ArcGIS 10.6, 10.6.1, 10.7.1, 10.8.1, 10.9, 10.9.1
  – Important Note: New Portal for ArcGIS patches (version B) were released on April 20, 2022.  Click the corresponding product version above for details.
• ArcGIS Server 10.6, 10.6.1, 10.7.1, 10.8.1, 10.9, 10.9.1
  – Important Note: New ArcGIS Server patches (version B) were released on April 11, 2022 to prevent BUG-000148146 on some AWS (Amazon Web Services) deployments. Click the corresponding product version above for details.

• ArcGIS Data Store 10.6, 10.6.1, 10.7.1, 10.8.1, 10.9, 10.9.1
• ArcGIS GeoEvent Server 10.6, 10.6.1, 10.7.1, 10.8.1, 10.9, 10.9.1
• ArcGIS Workflow Manager Server 10.9.1
• ArcGIS GeoEnrichment Server 10.7.1, 10.8.1, 10.9, 10.9.1
• ArcGIS Data Interoperability for Server 10.6, 10.6.1, 10.7.1, 10.8.1, 10.9, 10.9.1
• ArcGIS Notebook Server 10.7.1, 10.8.1, 10.9, 10.9.1
• ArcGIS Enterprise on Kubernetes 10.9.1.1611

See ArcGIS Enterprise Log4j Patch Summary Page

Patch Details:

• All Log4j 2.x components are updated to version 2.17.1, the latest version available at the time of this patch release.
  • For technical reasons, modified versions of some older Log4j 2.x files are left behind after patching. All Java classes have been removed from these files (considered “empty”) and only include metadata pointing to the new version 2.17.1 files. The older files that are left behind cannot be deleted without disrupting application functionality.
  • These emptied files will be entirely removed upon installation of the next ArcGIS Enterprise product release.
  • Security scanners that are inappropriately configured to detect vulnerable components solely based on file version numbers may detect false positives after these patches are applied.
•  All Log4j 1.2.x components have had vulnerable classes removed OR non-vulnerable Log4j bridge implemented.
  • Mitigated Log4j 1.2.x components are included with this patch due to dependencies on larger frameworks where Log4j bridge not implemented.
  • Esri will be removing Log4j 1.2.x components as part of the next product release, which includes further usage of the Log4j 1.x bridge, allowing removal of the old code, while providing compatibility for frameworks that don’t support Log4j 2.x directly yet.
  • Customers can use a validation tool such as Logpresso’s free Log4j-scan tool as described further in our cross-product Log4j announcement to confirm your files have been mitigated.

Log4j vulnerabilities addressed in these patches include:

CVEID: CVE-2021-44228 (Non-Esri issued 12/9/2021)

Description: JNDI features in Apache Log4j2 may allow an authenticated user to potentially enable escalation of privilege via network access.

CVSS Base Score: 10.0 Critical

CVSS Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2021-45046 (Non-Esri issued 12/14/2021)

Description: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

CVSS Base Score: 9.0 Critical

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE- 2021-4104 (Non-Esri issued 12/14/2021)

Description: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.

CVSS Base Score: 7.5 HIGH

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2021-45105 (Non-Esri issued 12/18/2021)

Description: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.

CVSS Base Score: 5.9 MEDIUM

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2021-44832 (Non-Esri issued 12/28/2021)

Description: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server.

CVSS Base Score: 6.6 MEDIUM

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2022-23305 (Non-Esri issued 1/18/2022)

Description: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVEID: CVE-2022-23302 (Non-Esri issued 1/18/2022)

Description: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to.

CVSS Base Score: 8.8 HIGH

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2022-23307 (Non-Esri issued 1/18/2022)

Description: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2020-9488 (Non-Esri issued 4/27/2020)

Description:  Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

CVSS Base Score: 3.7 LOW

CVSS Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2019-17571 (Non-Esri issued 12/20/2019)

Description: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

CVEID: CVE-2017-5645 (Non-Esri issued 4/17/2017)

Description: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS Base Score: 9.8 CRITICAL

CVSS Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ArcGIS Enterprise Exploit Code Maturity: Unproven

Cross-Product Guidance:

Due to the level of concern with Log4j vulnerabilities across industries, Esri provides cross-product guidance for Log4j concerns as a separate announcement here.

Acknowledgements:

These issues were found externally and were publicly disclosed via the National Vulnerability Database.

• Esri Software Security & Privacy Team