You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 14 Next »

More about the issue: https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

Apache Log4j2 version <2.15.0 is a part of the following products:

CATIA Magic portfolio

  • Magic Collaboration Studio (release 2021x Refresh1, 2021x Refresh2)
  • Magic Software Architect (release 2021x Refresh1, 2021x Refresh2)
  • Magic Cyber Systems Engineer (release 2021x Refresh1, 2021x Refresh2)
  • Magic Systems of Systems Architect (release 2021x Refresh1, 2021x Refresh2)

No Magic portfolio

  • Teamwork Cloud (release 2021x Refresh1, 2021x Refresh2)
  • Cameo Collaborator for Teamwork Cloud (release  2021x Refresh1, 2021x Refresh2)
  • MagicDraw (release 2021x Refresh1, 2021x Refresh2)
  • Cameo Systems Modeler (release 2021x Refresh1, 2021x Refresh2)
  • Cameo Enterprise Architecture (release 2021x Refresh1, 2021x Refresh2)

 

Apache Log4j2 version <2.15.0 is a part of the following products, however it is not used for logging:

CATIA Magic portfolio

  • Magic Collaboration Studio (release 2021x, 19.0 SP2, 19.0 SP3, 19.0 SP4)

No Magic portfolio

  • Cameo Collaborator for Teamwork Cloud (release  2021x, 19.0 SP1, 19.0 SP2, 19.0 SP3, 19.0 SP4)
  • Teamwork Cloud (release 2021x , 19.0 SP1, 19.0 SP2, 19.0 SP3, 19.0 SP4)


Remediation

For modeling tools (Magic Software Architect, Magic Cyber Systems Engineer, Magic Systems of Systems Architect , MagicDraw, Cameo Systems Modeler, Cameo Enterprise Architecture)

Option 1

  1. Download the latest log4j 2.15.0 patched version .
  2. Replace all log4j 2.x jar files with their respective equivalents from the downloaded version 2.15.0 zip file while keeping the original file name.

Example:

  • if found: log4j-core-2.11.2.jar
  • then remove log4j-core-2.11.2.jar
  • copy log4j-core-2.15.0.jar over to log4j-core-2.11.2.jar
  • repeat for any other log4j 2.x file found.

See the detailed procedure to mitigate the risk concerning the CVE-2021-44228 vulnerability. 

Option 2

If you cannot upgrade log4j, you may add 

 -Dlog4j.formatMsgNoLookups=true

as a command line option or add

log4j.formatMsgNoLookups=true

to a <modeling tool installation directory>\bin\<modeling tool>.properties file (e.g. magicdraw.properties, csm.properties, cameoea.properties) on the classpath to prevent lookups in the log event message.

 

For collaboration tools (Magic Collaboration Studio, Cameo Collaborator for Teamwork Cloud, Teamwork Cloud)

Option 1

You may prevent  lookups in the log event message by adding parameter via command line or in Web Application Platform setenv.sh / setenv.bat properties file.


Configuring setenv.bat file on Windows

If your instance of the Web Application Platform is running on Windows, configure this file by following one of the given workflows.

To configure setenv.bat files when the Web Application Platform is started by running an executable

  1. In the Java application server home directory (on which Web Application Platform runs), go to the bin folder. For example, if you use Apache Tomcat, go to <tomcat_home>\bin.
  2. Using a plain text editor, create the setenv.bat file in that directory if it does not already exist.

  3. Copy and paste the following line to the setenv.bat file:

    -Dlog4j.formatMsgNoLookups=true
  4. Save and close the file.
  5. Restart the Java application server.


To configure setenv.bat files when the Web Application Platform is started as a service

  1. Stop the Web Application Platform if it is running.
  2. Open the command-line interface and go to the Web Application Platform installation directory.

  3. In the command-line interface, run the following command:

    .\bin\tomcat<version>.exe //US//WebApp --JvmMs=8000 --JvmMx=8000 ++JvmOptions='-Dlog4j.formatMsgNoLookups=true'
  4. Restart the Web Application Platform.


Configuring setenv.sh file on Linux and Mac

If your instance of the Web Application Platform is running on Linux or Mac, configure this file by following the steps outlined below.

To configure setenv.sh file on Linux and Mac

  1. In the Java application server (on which Web Application Platform runs) home directory, go to the bin folder. For example, if you use Apache Tomcat, go to <tomcat_home>/bin.
  2. Using a plain text editor, create the setenv.sh file in that directory if it does not already exist.

  3. Copy and paste the following lines to the setenv.sh file:

    -Dlog4j.formatMsgNoLookups=true
  4. Save and close the file.
  5. Restart the Java application server.


Option 2 (more complicated)

  1. Download the latest log4j 2.15.0 patched version .
  2. Replace all log4j 2.x jar files with their respective equivalents from the downloaded version 2.15.0 zip file while keeping the original file name.

Example:

  • if found: log4j-core-2.11.2.jar
  • then remove log4j-core-2.11.2.jar
  • copy log4j-core-2.15.0.jar over to log4j-core-2.11.2.jar
  • repeat for any other log4j 2.x file found.

See the detailed procedure to mitigate the risk concerning the CVE-2021-44228 vulnerability. 

 

The following products and versions are NOT affected:

CATIA Magic portfolio

  • Magic Software Architect (release 2021x, 19.0 SP2, 19.0 SP3, 19.0 SP4)
  • Magic Cyber Systems Engineer (release 2021x, 19.0 SP2, 19.0 SP3, 19.0 SP4)
  • Magic Systems of Systems Architect (release 2021x, 19.0 SP2, 19.0 SP3, 19.0 SP4)

No Magic portfolio

  • Teamwork Cloud (release 19.0) 
  • Cameo Collaborator for Teamwork Cloud (release 19.0) 
  • MagicDraw (release 2021x, 19.0 and all service packs, 18.5 SP4, 18.0 SP7)
  • Cameo Systems Modeler (release 2021x, 19.0 and all service packs, 18.5 SP4, 18.0 SP7)
  • Cameo Enterprise Architecture (release 2021x, 19.0 and all service packs, 18.5 SP4, 18.0 SP7)