Apache Log4J 1.x Security Vulnerabilities (CVE-2021-4104, CVE-2019-17571, CVE-2022-23302, CVE-2022-23305, and CVE-2022-23307) – Impact on Windchill PLM & FLexPLM

Multiple CVEs have been reported against Apache Log4j 1.x.  As it is known to be out of support, analysis and justification is provided to confirm known impacts to Windchill PLM.

The product releases specified above in the 'Applies To' area all include the log4j1.2.17 version.

Vulnerable Apache Log4j versions for the identified CVEs: All 1.2.X versions up to 1.2.17

CVE-2021-4104
In Log4j 1.x the JMSAppender will perform a JNDI lookup if enabled in log4j’s configuration file.  Applications using Log4j 1.x may be impacted if their configuration uses JNDI (JMSAppender).

Base CVSS Score: 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat identified RHSB-2021-009 (CVE-2021-4104)
https://access.redhat.com/security/cve/CVE-2021-4104

Redhat Bugzilla Article includes additional details:
A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender.

CVE-2021-4104 only affects Log4j 1.2 when product is specifically configured to use JMSAppender, which is not the the OOTB configuration for Windchill.

CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Base CVSS Score:9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• The usage of SocketServer/SimpleSocketServer vulnerable classes comes into picture as a capability of Log4J’s SocketAppender that sends LoggingEvent objects to a remote a log server, usually a SocketNode. The SocketNode reads LoggingEvent objects sent from a remote client using Sockets (TCP). These logging events are logged according to local policy, as if they were generated locally. The SocketAppenders ships a serialized LoggingEvent object without any layout to the server side. On the remote host by deserializing you'll have access to all the same information and should be able to specify the layout that the logs are printed in.
• The log4j capability to access remote logs thru its SocketServer class (where the vulnerability exist) is not enabled in Windchill OOTB and there is no such call from the Windchill codebase.  Furthermore, there is no Windchill documentation that mentions enable/run the capability.

CVE-2019-17571 only affects if Log4j uses its features to access remote logs through its SocketServer class, Which is neither enabled in OOTB configuration for Windchill nor is called from codebase.

CVE-2022-23302
Base Score: 8.8 Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerable Apache Log4j versions: 1.x
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service th