Log4J2 Vulnerability to Zero-Day Exploit within CodeSonar and CodeSentry

Overview

CodeSecure has actively responded to the remote code execution vulnerability in the Apache log4j 2 Java library dubbed Log4Shell (or LogJam). We have investigated and taken action for CodeSecure products that may be potentially impacted, and as listed below we continually publish information to help customers detect, investigate and mitigate attacks, if any, to their CodeSecure products and services. 

CodeSonar's Java and .NET analyses use log4j. The possible attack vector would be through analysis of malicious java or .NET code that has been crafted to take advantage of this vulnerability. It is important to note *no* network servers are affected.

CodeSonar 6.2

This release includes log4j 2.17.0 which resolves the threat posed by remote code execution and does not require any changes. 

CodeSonar 6.0 and 6.1

Customers not analyzing java or .NET code (i.e., running cs-java-scan or cs-dotnet-scan) are not affected.  Customers not analyzing java or .NET code can delete codesonar-CodeSonar_DIR/csurf/lib/codesonarj-cli-pp/log4j-*.jar to silence complaints from vulnerability scanning tools, without fear of breaking CodeSonar.

Customers who are analyzing Java or .NET code should mitigate the risk by using a patched release of CodeSonar.  If you are not using a patched installer removing the JndiLookup and JndiManager classes from CodeSonar_DIR/csurf/lib/codesonarj-cli-pp/log4j-core.jar would eliminate risk, but may or may not cause CodeSonar to experience errors.

CodeSonar 5.4 and earlier

With CodeSonar 5.4 and earlier, log4j is only used if cs-java-scan or cs-dotnet-scan is used with the '-julia-analyze' command line flag. To silence complaints from vulnerability scanning tools, one can delete codesonar-5.4p0/third-party/julia-tools/lib/log4j-*.jar and codesonar-5.4p0/third-party/julia-sarif/lib/log4j-*.jar. As long as '-julia-analyze' is not used, CodeSonar functionality will not be impaired.

If you are using Standalone CodeSonar 3.2 (Java/C#) or JuliaSoft 3.0 then the advice is to move to a supported release of CodeSonar, namely 6.x. If you require assistance in upgrading please submit a  ticket.

Patched Installer Updates

The following timelines for patched releases can be found below.

As per the Apache home page, the fix to CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. In version 2.16.0, Log4j disables access to JNDI by default, see CVE-2021-45046. In version 2.17.0, there is a fix, so does not always protect from infinite recursion in lookup evaluation, see CVE-2021-45105.

Downloading Updated Installers

Downloading CodeSonar for Source can be done here

Download CodeSonar for Binaries can be done here

Latest Log4j Updates

In version 2.17.0, a vulnerability to RCE via JDBC Appender when attacker controls configuration, see CVE-2021-44832 was reported and the following advice is available to customers.

CodeSecure has carefully evaluated the risk of the most recently reported vulnerability in log4j. Based on the fact that the exploit requires elevated privilege and direct access to the configuration of log4j in CodeSonar, we have assessed the risk to our users as low. 

On Friday 7th January 2022, CodeSonar 6.2p2 was released which now includes log4j 2.17.1 and supersedes 6.2p1 which was released on Tuesday 21st December 2021. At this time no further patching will take place on any supported version of CodeSonar which includes 6.1p3 and 6.0p2. 

We will assess and update alternative strategies, and will update our plans for future remediation if there are any changes to log4j. 

If you do have any other questions or concerns please submit a ticket.  

Article Change History

We recommend you follow the support advisory section and this article to receive email updates on when comments are added to this article.