HighQ - Log4j Vulnerability - Maintenance Work This Weekend

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Salamon — Fri, 07 Jan 2022 14:54:00 GMT

Thanks Mark! Appreciate the updated info. Have a great weekend.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Edwards — Fri, 07 Jan 2022 10:27:00 GMT

Mark apologies for any ambiguity, that was not my intention. Obviously, with the ever evolving situation, we are having to monitor the situation carefully and provide centralized communications to our entire customer base when necessary.

From your perspective, your HighQ platform instance is now using log4j 2.17.0 as standard. This will be updated to 2.17.1 with the next maintenance release for the platform, which will begin deployment from next week onward. Should the risk assessment change, then we will of course accelerate that.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Salamon — Thu, 06 Jan 2022 22:18:00 GMT

Mark. Thanks for this. Apologies, as your response was a bit ambiguous. :( When you say: "The majority of our platform elements are now using 2.17.0 as standard in production and we will be supplementing this with 2.17.1 over the coming weeks where necessary."

Does that mean currently EVERYTHING is on 2.17.x: some things are on 2.17.0, the rest are on 2.17.1, and anything on 2.17.0 will be upgraded to 2.17.1 in the coming weeks?

Or does this mean that some things are still on 2.16.x currently, but that everything will be upgraded to 2.17.x in the coming weeks?

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Edwards — Thu, 06 Jan 2022 21:10:00 GMT

Hi Mark. Thanks for following up. As I mentioned above, our plan following the initial remediation of the vulnerabilities was to ensure that we kept our log4j components up to date in subsequent maintenance releases, which is exactly what has happened. The majority of our platform elements are now using 2.17.0 as standard in production and we will be supplementing this with 2.17.1 over the coming weeks where necessary.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Salamon — Thu, 06 Jan 2022 19:58:00 GMT

Mark Edwards My security team is pressing for an answer on the current state of the patch. I asked you "so no plan to upgrade to 2.17 for the main platform?" and you replied ambiguously: "Yes, absolutely."

Will HighQ be updating the main platform to 2.17 or is the answer that you don't feel there is a need to do this? If you plan to upgrade to 2.17, has this happened yet and if not, do you know when.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Edwards — Thu, 23 Dec 2021 00:41:00 GMT

Yes, absolutely. As per the above, the plan is to keep up to date in subsequent maintenance releases. However, the current view is that there is no need for immediate action to do this due to other safeguards.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Salamon — Thu, 23 Dec 2021 00:13:00 GMT

Mark Edwards so no plan to upgrade to 2.17 for the main platform?

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Edwards — Thu, 23 Dec 2021 00:03:00 GMT

Hi Mark - we are currently running Log4j 2.16.0 in our main platform applications and 2.17.0 in our Appliance. Our security teams are constantly monitoring the situation and will advise if anything needs to change in the short term. For now, I believe the plan is to ensure that we keep up to date in subsequent maintenance releases as a precaution but there is no need for immediate action at present.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Salamon — Wed, 22 Dec 2021 22:53:00 GMT

Mark Edwards Can you let us know what version of Log4j is currently installed, at least in the online service? My security team is asking about this, given that Apache has needed to issue 3 patches. If there is another maintenance patch to be released, can you provide details on when and what version will be installed. Thank you!

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Mark Edwards — Tue, 21 Dec 2021 12:32:00 GMT

It certainly seems to be the 'gift' that keeps on giving... Thanks for highlighting Andrew - our teams are already on it will follow up as soon as possible to advise our next steps.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Andrew Quinn — Mon, 20 Dec 2021 22:22:00 GMT

"But Wait...There's more!!!" - 2.17 released to mitigate CVE-2021-45105 which I believe also aims to mitigate the WebSockets PoC vulnerability

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Carl Walker — Mon, 20 Dec 2021 09:43:00 GMT

Peter, perfect. thanks for confirming.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Robyn Tippins — Mon, 20 Dec 2021 09:34:00 GMT

Carl Walker 2.16! Please go ahead and do the Appliance upgrade without us... The wording of the email was just incase there are people not comfortable doing it themselves.

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Carl Walker — Mon, 20 Dec 2021 09:29:00 GMT

Peter, do I? II have seen the email and downloaded the Appliance upgrade files. I have done numerous Appliance upgrades without HighQ been on a screen share. Happy to do a screen share but before raising the emergency change, my question still stands, does the upgrade include log4j v 2.15 or log4j v 2.16?

RE: HighQ - Log4j Vulnerability - Maintenance Work This Weekend

Robyn Tippins — Mon, 20 Dec 2021 09:20:00 GMT

Carl Walker No - you host the Appliance in your own IT infrastructure, so you will need to reply to my email! :)