December 20, 2021 10:00est.
The security vulnerability CVE-2021-44228,https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228 (also known as Log4Shell) is a bug that gives easy access to java-based applications (Log4J), making them susceptible to data theft and loss, and malware attacks. As a result of CVE-2021-44228, it was discovered that the mitigation steps were incomplete and CVE-2021-45046, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 could occur, resulting in a possible denial of service (DOS) attack. As a result of CVE-2021-45046, it was discovered that the mitigation steps were incomplete and CVE-2021-45105, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105 could occur, resulting in a possible uncontrolled recursion from self-referential lookups.
DocuShare utilizes Java in its deployment. Based on CVE-2021-44228 and CVE-2021-45046, these vulnerabilities affect version 7.5 of DocuShare using Solr search only. This applies only to new installations of DocuShare 7.5 that were not upgraded from a prior version. DocuShare Flex and older versions of DocuShare are not impacted by this vulnerability.
To test if your installation of DocuShare 7.5 uses Solr search use the following URL from your DocuShare server: http://127.0.0.1:8983/solr/#/ If there is a response, Solr is in place using the default port.
|
|
Log4Shell Status |
Reason |
|
DocuShare Go |
Remediated - currently unaffected - no action required |
Remediated Log4j2 is in use. |
|
DocuShare 6.6.1 |
Unaffected - no action required |
Unaffected version of Log4j is in use. |
|
DocuShare 7.0 |
Unaffected - no action required |
Unaffected version of Log4j is in use. |
|
DocuShare 7.5 using Solr search only |
Affected – Xerox has developed a hotfix to address both issues – Available here |
Log4j2 is in use. |
|
DocuShare Flex 2.6 |
Unaffected - no action required |
Unaffected version of Log4j is in use. |
To read more about the Log4Shell vulnerability and how this affects Java based deployments please visit: https://logging.apache.org/log4j/2.x/security.html
*I have DocuShare 7.5 with Solr, what should I do to protect myself?
Customers using DocuShare 7.5 and Solr should apply the hotfix to correct both issues located: Available here
*If your DocuShare 7.5 servers are hosted with Xerox, we’ve got you covered. The update will be applied before close of business today.
For questions, please contact DocuShare Support at docushare.support@xerox.com or call 1-800-835-9013. Further updates can be found at: https://help.carear.com/hc/en-us/articles/4415942561175
Best Regards,
The DocuShare Team