How to quickly mitigate Log4J critical vulnerability?

There is a lot of discussion around the Log4J CVE in the community. If you haven’t heard or read about it then below is the good read

The Sitecore versions that got affected are:
Sitecore XP 9.2
Sitecore XP 9.3
Sitecore XP 10.0
Sitecore XP 10.1
Sitecore XP 10.2

Versions not affected 

  • Sitecore XP 9.1 and earlier versions are not affected by this vulnerability.
  • Sitecore Managed Cloud customers who host Solr using SearchStax are not affected by the issue.
  • Sitecore XP and Managed Cloud customers who do not use Solr are not impacted.
  • The vulnerability does not impact the Azure Search engine.

Solution to fix it:

  • Upgrade to Solr 8.11.1 or greater (when available), which will include an updated version of the log4j2 dependency.
  • Manually update the version of log4j2 on your runtime classpath and restart your Solr application.
  • (Windows) Edit your solr.in.cmd file to include: set SOLR_OPTS=%SOLR_OPTS% -Dlog4j2.formatMsgNoLookups=true

Reference link – https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228

We fixed it quickly by following the third solution as our SOLR endpoints were not exposed to internet but the best solution is to upgrade the SOLR.

Hope it helps..

Thank you.. Keep Learning.. Keep Sitecoring..

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s