Event[edit | edit source]

Log4j vulnerability

Current vulnerability assessment in BlueSpice (overview)[edit | edit source]

This is true for instances that we have installed. Customers have to check their part of the installation (i.e., OS, additional packages, etc.)

Detailed assessment[edit | edit source]

Current version[edit | edit source]

Older versions of BlueSpice 3[edit | edit source]

  • Elasticsearch => not vulnerable
    https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476
    • Versions 6.8.9+ (released on 13th May 2020) => not vulnerable
    • Version 6.4.0 - 6.8.8: Update of Elasticsearch is recommended.
      => not vulnerable (updating the version during the next BlueSpice update is recommended)
      => vulnerable outside of BlueSpice
    • Versions 6.3.x and below: Update of Elasticsearch is recommended.
      => not vulnerable (updating the version during the next BlueSpice update is recommended)
      => vulnerable outside of BlueSpice

Independently of the Elasticsearch version in use, BlueSpice is not vulnerable due to the setup of Elasticsearch:

  • No direct access: BlueSpice uses Elasticsearch as an internal service. We set up Elasticsearch in such a way that there cannot be any direct access. The only way to access Elasticsearch if you are not working directly on the server is through BlueSpice, which means there is a very controlled set of access vectors. These are search queries and content which is to be indexed.
  • No logging of data: We use log level WARN on Elasticsearch, which means no data can find its way to the logs. So there is no way an attacker can add custom information to the logs.

No pass-through of user data: All communication between BlueSpice and Elasticsearch is done user-agnostic. There is no way Elasticsearch can see which user triggers the communication. The user-agent is restricted to the BlueSpice system user.

This is true even if you are running on an older, vulnerable version of Elasticsearch. So we see no urgent action required. Nonetheless, it is recommended to update your Elasticsearch to a non-vulnerable version with the next update of BlueSpice.

If you have changed the Elasticsearch setup to a different log level or loosened the restrictions on Elasticsearch access, you have to check the setup.

BlueSpice 2[edit | edit source]

Inspected components in the Docker image[edit | edit source]

The list of Docker files in the activated packages has been inspected. => not vulnerable

BlueSpice Cloud[edit | edit source]

  • Swarmpit => not affected
  • Drone => not affected


Related links[edit | edit source]



No categories assignedEdit

Discussions