CVE-2021-44228 Statement

13 December 2021

Micro Focus is taking immediate action to analyze and to remediate, where appropriate, Common Vulnerabilities and Exposures (CVE-2021-44228 / Log4j also known as Log4shell / Logjam), a reported vulnerability in the Apache Log4j open source-component that allows Remote Code Execution. Using the Remote Code Execution an attacker can potentially run malicious code that can perform unauthorized operations. This is defined by the Common Vulnerability Scoring System(CVSS) as a level 10 exploit. Micro Focus uses Log4j for standard logging functionality across a number of product portfolios. We are actively remediating the vulnerability across those products to protect both SaaS and on-premises customers and issuing security bulletins with instructions on how to remediate for on-premises installations. We will continue to provide details of the Log4j compromise until the risk is completely mitigated.

After investigation and analysis, we have had no indications of Log4j intrusions to date.

CVE-2021-45046 Statement

15 December 2021

A new zero-day vulnerability (CVE-2021-45046) Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack has been reported for the Apache Log4j component on December 14th 2021. Micro Focus is taking immediate action to analyze and to remediate, where appropriate, Common Vulnerabilities and Exposures (CVE-2021-45046) is a reported vulnerability in the Apache Log4j open source-component that allows a denial of service (DOS) attack. The vulnerability can allow an attacker to perform a denial of service attack impacting application performance or potentially stopping an application from running. This is defined by the Common Vulnerability Scoring System (CVSS) as a level 3.7 exploit. Micro Focus uses Log4j for standard logging functionality across a number of product portfolios. We are actively remediating the vulnerability across those products to protect both SaaS and on-premises customers and issuing security bulletins with instructions on how to remediate for on-premises installations. We will continue to provide details of the Log4j CVE-2021-45046 vulnerability until the risk is completely mitigated.

After investigation and analysis, we have had no indications of Log4j intrusions to date.

CVE-2021-45105 Statement

20 December 2021

A new zero-day vulnerability (CVE-2021-45105) (Apache Log4j2 - does not always protect from infinite recursion in lookup evaluation) was reported by Apache for the Apache Log4j component on December 18, 2021. Micro Focus is taking immediate action to analyse and to remediate where appropriate. The reported vulnerability (CVE-2021-45105 / Apache Log4j2) is in the Apache Log4j open source-component that allows Remote Code Execution. This enables an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This is defined by the Common Vulnerability Scoring System(CVSS) as a level 7.5 exploit. Micro Focus uses Log4j for standard logging functionality across a number of product portfolios. We are actively remediating the vulnerability across those products to protect both SaaS and on-premises customers and issuing security bulletins with instructions on how to remediate for on-premises installations. We will continue to provide details of the Log4j compromise until the risk is completely mitigated.

After investigation and analysis, we have had no indications of Log4j intrusions to date.

CVE-2021-44832 Statement

6 January 2022

Micro Focus is taking immediate action to analyze and to remediate, where appropriate, Common Vulnerabilities and Exposures CVE-2021-44832 /Apache Log4j 2 Vulnerability, a reported vulnerability in the Apache Log4j open source-component that allows Remote Code Execution. Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server.

Micro Focus uses Log4j for standard logging functionality across several product portfolios. CVE-2021-44832 is a medium risk vulnerability with a CVSS of 6.6. We are remediating the vulnerability according to our medium risk vulnerability remediation process across those products to protect both SaaS and on-premises customers and issuing security bulletins with instructions on how to remediate for on-premises installations. We will continue to provide details of the Log4j compromise until the risk is completely mitigated. Please watch our Support Portal for relevant Security Bulletins.

After investigation and analysis, we have had no indications of Log4j intrusions to date.

Micro Focus Secure Development Process

Micro Focus uses a mature formal process to handle vulnerabilities that are identified both internally and externally. We have a robust, dedicated, full-time threat intelligence team with a Micro Focus-wide view, that is constantly reviewing new reports of vulnerabilities, threats and compromises for possible impact to our products and network.

Micro Focus operates a Secure Development Lifecycle that includes among other practices, a Supply Chain Security practice, 3rd Party Component Manifest and a 3rd Party Component Monitoring. Using these formal practices we ensure 3rd party components are sourced from trusted repositories, scanned and tested, free of known CVEs, and signed to ensure authenticity and integrity. New vulnerabilities are scanned and tracked to ensure closure. Unsupported 3rd party components are deprecated.

Micro Focus has a formal practice of secure software coding that is designed to protect against malicious code, backdoors, transitive dependency based vulnerabilities and other threats.

Micro Focus is actively implementing patches and mitigation measures where appropriate for the Log4j vulnerability. Zero-Day and Critical vulnerabilities are fast tracked and delivered outside the product’s major point release cycle. We rank potential patches according to CVSS scoring, and also our own enhanced scoring system that takes additional data points into account. Configuration changes or patch installations require Quality Assurance analysis and testing prior to deployment to production systems to prevent unexpected service interruptions.