Summary

A vulnerability identified as CVE-2021-44228 has been reported in the Apache Log4j library. This vulnerability may allow for remote code execution in susceptible products.

Description

Code Insight v6 and v7 are not impacted by CVE-2021-44228.

The table below lists Code Insight v6 and v7 components, and the logging frameworks used in those components.

SLF4J is a wrapper logging framework which can use one of the logging implementations like logback, log4j, java.util.logging, etc. In the Code Aware module, we use SLF4 logging, which in turn points to and uses native implementation of logback library.

Log4j 2 jar files are shipped and present in the Code Insight install location, however Log4j 2x library is neither:

• Configured to be used with SLF4j.
• Nor directly referenced in the code.

Hence, despite the presence of Log4j 2 files in the Code Insight application, it can be confirmed that Log4j 2 libraries are not used for logging.

Resolution

No fix is required.

Workaround

As Code Insight has no dependency on the included Log4j 2 libraries, these can be deleted using the instructions below:

Remediation Steps for Code Insight v7.x

Perform the following steps to remove Log4j 2 files from Code Insight in case of standalone installation (Core and Scan server in the same machine):

1. Log in as the user who performed the Code Insight installation.
2. Shut down the Code Insight application. (or stop the service if configured in service mode).
3. Navigate to $Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib
4. Delete files log4j-api-2.11.1.jar and log4j-core-2.11.1.jar from the directory
5. Delete the codeaware.war file from $Codeinsight_Install_Location\tomcat\webapps folder. The following steps remove log4j jar files from Code Aware component which is used by plugins or standalone scanner for scan.
6. Navigate to $Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes.
7. Take a backup of the codeaware-embedded-<Version>.zip file.
8. Navigate to:
   • Linux: $Codeinsight_Install_Location/7-zip/lnx64
     or
   • Windows: $Codeinsight_install_location\7-zip\win64
9. Execute below command from terminal or command prompt to remove log4j-api-2.11.1.jar and log4j-core-2.11.1.jar from the codeaware-embedded-<Version>.zip. This command used the 7z tool supplied with application to remove files with in the zip file
   • Linux: - ./7z d Codeinsight_Install_Location/tomcat/webapps/codeinsight/WEB-INF/classes/codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
   • Windows: 7z.exe d Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes\codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
10. Start the Code Insight application

Removing Log4j 2 files from Code Insight When Core and Scan Servers on Different Machines

This section contains the steps to remove Log4j 2 files from Code Insight in case of Core and Scan servers installed on different machines

Scan Server(s)

Perform these steps on each scan server:

1. Log in as the user who performed the Code Insight installation.
2. Shutdown the Code Insight scanner application (or stop the service if configured in service mode).
3. Navigate to $Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib.
4. Delete files log4j-api-2.11.1.jar and log4j-core-2.11.1.jar from the directory.
5. Delete the codeaware.war from the $Codeinsight_Install_Location\tomcat\webapps folder.
6. Start the Code Insight scanner server. (Perform this step after completing steps on core server.)

Core Server(s)

Perform these steps on each core server.

1. Log in as the user who performed the Code Insight installation.
2. Shutdown the Code Insight core application (or stop the service if configured in service mode). Following steps removes log4j jar files from Code Aware component which is used by plugins or standalone scanner for scan.
3. Navigate to $Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes.
4. Take the back up of the codeaware-embedded-<Version>.zip file.
5. Navigate to
   • Linux: $Codeinsight_Install_Location/7-zip/lnx64
     or
   • Windows: $Codeinsight_install_location\7-zip\win64
6. Execute below command from terminal or command prompt to remove log4j-api-2.11.1.jar and log4j-core-2.11.1.jar from the codeaware-embedded-<Version>.zip. This command used the 7z tool supplied with application to remove files with in the zip file.
   • Linux: - ./7z d Codeinsight_Install_Location/tomcat/webapps/codeinsight/WEB-INF/classes/codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
   • Windows: - 7z.exe d Codeinsight_Install_Location\tomcat\webapps\codeinsight\WEB-INF\classes\codeaware-embedded-<Version>.zip log4j-api-2.11.1.jar log4j-core-2.11.1.jar -r
7. Start the Code Insight core server.

Scan Plugin and Standalone Scanner Changes

The following steps are to be performed for cases in which the scan plugins or standalone scanner are in use for scanning. Since the plugins and standalone scanner download codeaware-embedded-<Version>.zip during scan, you are likely to find old references to the log4 jars on these machines. The following steps will delete all references to this file.

If no plugins or standalone scanner are in use, the following steps can be skipped.

1. On the machine(s), where the plugin or standalone scanner is configured, locate the user who performed the Code Insight installation or executed the plugin or standalone scanner.
2. Delete the directory $user_dir/.codeinsight. Refer the example below:
   • Linux: /home/<user>/.codeinsight
   • Windows: C:/Users/<user>/.codeinsight

• The .codeinsight directory in case of Linux would be a hidden directory (perform ls -al to list .codeinsight directory).
• In case of Jenkins or Bamboo plugins, if remote agent nodes are configured, above step has to be done on the remote agent nodes.

Remediation Steps for Code Insight v6.x / Core and Scan Servers on Same Machine 

To remove log4j v2.x files from Code Insight in case of standalone installation (Core & Scan server in the same machine), perform the following steps:

1. Log in as the user who performed the Code Insight installation.
2. Shut down the Code Insight application. (or stop the service if configured in service mode)
3. Navigate to $Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib.
4. Delete files log4j-api-2.11.1.jar and log4j-core-2.11.1.jar from the directory.
5. Delete the codeaware.war from the $Codeinsight_Install_Location\tomcat\webapps folder.
6. Start the Code Insight application.

Remediation Steps for Code Insight v6.x / Core and Scan Servers on Different Machines 

To remove Log4j 2 files from Code Insight in case of Core and Scan servers installed on different machines, perform the following steps on each scan server:

1. Log in as the user who performed the Code Insight installation.
2. Shut down the Code Insight scanner application (or stop the service if configured in service mode).
3. Navigate to $Codeinsight_Install_Location\tomcat\webapps\codeaware\WEB-INF\lib.
4. Delete files log4j-api-2.11.1.jar and log4j-core-2.11.1.jar from the directory.
5. Delete the codeaware.war from $Codeinsight_Install_Location\tomcat\webapps folder.
6. Start the Code Insight scanner server.