Security Bulletin Update - Log4J Issue (CVE-2021-44228)

NOTE: This incident is no longer considered active, but is being maintained as Monitoring for short-term visibility.

This is an update of Idera's internal review of the Log4J Issue (CVE-2021-44228). Idera has completed its review / investigation on all family of products.

For products supported in this portal, our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. Therefore, the investigation confidently concludes none are impacted by the Apache Log4j vulnerability. For specific security bulletin updates regarding Qubole and Xblend / Xray, please review the information provided in the support portals for those products.

Although our initial and thorough investigation has concluded, Idera continues to monitor for potential breaches, we will continue actively to monitor this situation and communicate with stakeholders as appropriate.

Idera Security Bulletin CVE-2021-4104

Current Description

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.

Idera does not use JMSAppender within our products so we are not impacted by this new CVE.

If you have any questions or concerns please contact us.

Idera Security and Compliance Team.
If this is your first visit, you may have to register before you can post. To start viewing messages, select the forum that you want to visit from the selection below.

Results 1 to 4 of 4

Thread: displayTpl breaks ComboBox in 6.5.3

Thread Tools
- Show Printable Version
Search Thread
- Advanced Search
Display
- Linear Mode
- Switch to Hybrid Mode
- Switch to Threaded Mode

You found a bug! We've classified it as EXTJS-27618 . We encourage you to continue the discussion and to find an acceptable workaround while we work on a permanent fix.

4 Oct 2018, 9:18 AM #1
pauldugas

View Profile

View Forum Posts

Private Message
Join Date

Nov 2010

Location

Canton, GA, USA

Posts

190
displayTpl breaks ComboBox in 6.5.3

Ran into this one a couple days ago. Seems using displayTpl in a ComboBox breaks things rather strangely. See original thread with Fiddles linked below.

https://www.sencha.com/forum/showthr...bobox-Behavior
8 Oct 2018, 4:15 PM #2
Forum_Adm

View Profile

View Forum Posts

Private Message
Sencha - Forum Administrator

Join Date

Sep 2017

Posts

1,005
Thank you so much for bringing this to our attention Paul. I have sent this over to the support team. We appreciate your patience while we work on this.

Thanks,
Michele
23 Oct 2018, 8:40 AM #3
pakumar

View Profile

View Forum Posts

Private Message
Sencha Staff

Join Date

Sep 2017

Posts

126
Thanks for the report! I have opened a bug in our bug tracker.
10 Dec 2019, 3:52 AM #4
niteshjainttl

View Profile

View Forum Posts

Private Message
Sencha Premium Member

Join Date

Jan 2016

Posts

33
Has the permanent fix been done?