Tririga and Log4J vulnerability

Luis

Hi,

We are currently running Tririga 3.6.0.4, is this the latest information about Log4J impacting Tririga?

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tririga-reporting-a-component-of-ibm-tririga-application-platform-is-vulnerable-to-denial-of-service-and-arbitrary-code-execution-due-to-apache-log4j-cve-2021-44228/

Here mentions that only 3.8 and 4.0 are affected. Isn't 3.6.0.4 affected?

Report from Tenable (Nessus) scan lists the following files as having vulnerable Log4J:

(Tririga_Install_Path)\ibm-tririga.war -version 1.2.16

Admin

Luis Hi Luis, here's a reply from Jeff at Support:

I think we would need to know specifically WHICH log4j vulnerability they are referring to. The original one that started this mess was around a log4j 2.x release, which we did not have because we were on an older (unsupported) version of log4j in the 1.x release stream.

If they're talking about vulnerabilities in the 1.x that we ship with, there is one with the appender, but TRIRIGA does not use the appender. (This is why we will be removing that class from the shipping product, we do not use it anywhere.)

Admin

Luis To add to Support's response, from what I can tell from your link, "IBM TRIRIGA Reporting" might be referring to the separate TRIRIGA add-on (dashboard), not the general reporting functionality in the TRIRIGA platform.

IBM TRIRIGA Add-ons
https://www.notion.so/tririgafeedia/IBM-TRIRIGA-Add-ons-86524dba6c9a46c99b81d1012c099c51

Luis

Hi,

As per our security team, any version lesser than apache-log4j-2.21.1 is considered vulnerable, Tririga latest version is using 2.17.2.

Is it possible to upgrade the Log4j or apply a fix pack?

Regards.

Admin

Luis Hi Luis, I'll forward your question to the team. Thx!

Admin

Luis Hi Luis, the internal discussion is ongoing. I cannot guarantee anything, but to summarize their discussion:

"We upgraded to 2.17.2 last year. It doesn’t have any direct vulnerabilities, but has ... vulnerabilities from dependencies ... Even the latest log4j version 2.21.1 also has vulnerabilities from dependencies ... However, we will discuss this with our security team and upgrade in upcoming releases accordingly. Hope this helps".

If necessary, you can follow up with IBM Support.