A critical zero-day vulnerability has been reported in the 3rd party library log4j.
This article has been created to provide customers with information and recommended actions.
Analysis and investigation is on-going:

• Check this article regularly for additional updates to ensure you have the latest details.

Currently, following vulnerabilities are known:

• CVE-2021-44228
  Base CVSS Score: 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• The following vulnerability has also been reported which is related to the above CVE. It is recommended to also address on priority.
  CVE-2021-45046
  Base CVSS Score: 9.0  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
  Vulnerable Apache log4j versions for the CVEs above: all versions from 2.0-beta9 to 2.15.0
• The following CVE was reported by Apache against log4j versions 2.0-beta9 to 2.16:
  CVE-2021-45105
  Base CVSS Score:7.5   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  Vulnerable Apache Log4j versions for the CVE: 2.0-beta7 to 2.16
• The following CVE was reported by Apache against Log4j 2.17:
  CVE-2021-44832
  Base CVSS Score:6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
  Vulnerable Apache Log4j versions for the CVE:2.0-beta7 to 2.17.0

• Refer to Apache article for more details :
  https://logging.apache.org/log4j/2.x/security.html

 

IMPORTANT NOTE:

• Due to the criticality of this reported vulnerability, PTC STRONGLY RECOMMENDS taking IMMEDIATE action to ensure all impacted Windchill instances are secure.

• There are no known exploits reported for Windchill at this time.
  Investigation is on-going to identify any potential attack surface.

• All instances (dev, test and prod) are impacted and any Windchill deployment of the impacted releases should be updated as per recommendations below. This includes updating all Windchill file servers.

 

IMPACT ON WINDCHILL RELEASES:

• Windchill includes the log4j library for native logging capabilities. (see below for impacts related to supported 3rd party bundled components that integrate directly with Windchill)

 

• Additional Windchill Components:

• Additional analysis has been done form Windchill components to identify any impact or risk.
• Please see resolution for information on Additional Windchill Components.

• Impacts to 3rd Party Bundled Components:

• While earlier Windchill releases (prior to 12.0.2.0) may not include the vulnerable log4j version, supported 3rd party bundled components may still be vulnerable.
• The Windchill impact analysis includes review of the following 3rd party bundled components:
  • Solr
  • Cognos
  • Tibco

• Refer to the table below (Resolution Section) for the latest updates for each 3rd Party Component.

 

IMPACT TO INTEGRATED PTC APPLICATIONS/SOLUTIONS:

• FlexPLM - Recommended actions should be followed.  Any additional considerations will be provided when/if they become available.
• Navigate/ThingWorx - CS359107
• Ping Federate - CS358902
• Shibboleth SP - Not affected.  Refer to the Shibboleth Announcement for further details
• Wincom - Not affected

 

Additional locations in Windchill Codebase where Log4j 2.x is found:

• There are additional locations in the Windchill codebase where log4j2.x is included.
• The use of log4j in these locations is not exploitable. 
• However, for customers who require all log4j instances to be up to date to meet security requirements, additional steps may be needed to remove log4j in these locations: