<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi folks</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Two more CVEs have come to our attention which seem to affect log4j v1.2:</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<a target="_blank" class="c-link" data-stringify-link="https://nvd.nist.gov/vuln/detail/CVE-2019-17571" data-sk="tooltip_parent" href="https://nvd.nist.gov/vuln/detail/CVE-2019-17571" rel="noopener noreferrer" tabindex="-1" data-remove-tab-index="true" style="font-weight: 400; font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; font-variant-ligatures: common-ligatures; orphans: 2; text-align: left; widows: 2; color: rgba(var(--sk_highlight,18,100,163),1); background-color: rgb(248, 248, 248);">https://nvd.nist.gov/vuln/detail/CVE-2019-17571</a><span style="font-weight: 400; font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; font-variant-ligatures: common-ligatures; orphans: 2; text-align: left; widows: 2; color: rgb(29, 28, 29); background-color: rgb(248, 248, 248); display: inline !important;"> </span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-weight: 400; font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; font-variant-ligatures: common-ligatures; orphans: 2; text-align: left; widows: 2; color: rgb(29, 28, 29); background-color: rgb(248, 248, 248); display: inline !important;">and</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-weight: 400; font-family: Slack-Lato, appleLogo, sans-serif; font-size: 15px; font-variant-ligatures: common-ligatures; orphans: 2; text-align: left; widows: 2; color: rgb(29, 28, 29); background-color: rgb(248, 248, 248); display: inline !important;"><a target="_blank" class="c-link" data-stringify-link="https://access.redhat.com/security/cve/CVE-2021-4104" data-sk="tooltip_parent" href="https://access.redhat.com/security/cve/CVE-2021-4104" rel="noopener noreferrer" tabindex="-1" data-remove-tab-index="true" style="font-weight: 400; text-decoration: underline; font-variant-ligatures: common-ligatures; color: rgba(var(--sk_highlight_hover,11,76,140),1); background-color: rgb(248, 248, 248);" id="LPlnk153981">https://access.redhat.com/security/cve/CVE-2021-4104</a><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
They seem to only come into play if you use the JMSAppender or the SocketAppender. We can only see log4j (on v2.7/v2.8) being used in the </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-weight: normal; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">./gems/gems/mizuno-0.6.11/lib/java/log4j-1.2.17.jar</span></p>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">But I can't see any properties associated with that to see if uses either of these.
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Assume it's not a problem, but thought I'd flag it up in case.</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Cheers</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Scott</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">==========</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Scott Renton</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Digital Library Development & Systems</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Floor F East</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">Argyle House</p>
<p style="margin-top:0px; margin-bottom:0px; margin-top:0; margin-bottom:0">515219</p>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> archivesspace_users_group-bounces@lyralists.lyrasis.org <archivesspace_users_group-bounces@lyralists.lyrasis.org> on behalf of Steele, Henry
<Henry.Steele@tufts.edu><br>
<b>Sent:</b> 14 December 2021 16:25<br>
<b>To:</b> Archivesspace Users Group <archivesspace_users_group@lyralists.lyrasis.org><br>
<b>Subject:</b> Re: [Archivesspace_Users_Group] log4j vulnerability in ArchivesSpace?</font>
<div> </div>
</div>
<div dir="auto">
<div style="background-color:#fff2e6; border:2px dotted #ff884d"><span style="font-size:12pt; font-family:sans-serif; color:black; font-weight:bold; padding:.2em">This email was sent to you by someone outside the University.</span>
<div style="font-size:10pt; font-family:sans-serif; font-style:normal; padding:.2em">
You should only click on links or attachments if you are certain that the email is genuine and the content is safe.</div>
</div>
<div>It uses JRuby<br>
<div dir="ltr"><br>
<blockquote type="cite">On Dec 14, 2021, at 11:19 AM, Steele, Henry <Henry.Steele@tufts.edu> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr"> I’m not sure who supports this now—HM?—, but I wanted to check about the Yale EAD exporter’s potential vulnerability. It’s a plug-in but also has a stand alone application <br>
<div dir="ltr"><br>
</div>
<br>
<div dir="ltr"><br>
</div>
<div dir="ltr"><br>
<blockquote type="cite">On Dec 13, 2021, at 2:01 PM, Blake Carver <blake.carver@lyrasis.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Nope, older versions should be safe as well.</div>
<div>
<div id="x_Signature">
<div>
<div id="x_divtagdefaultwrapper" dir="ltr" style="color:rgb(0,0,0); background-color:rgb(255,255,255)">
</div>
</div>
</div>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> archivesspace_users_group-bounces@lyralists.lyrasis.org <archivesspace_users_group-bounces@lyralists.lyrasis.org> on behalf of Steele, Henry
<Henry.Steele@tufts.edu><br>
<b>Sent:</b> Monday, December 13, 2021 1:52 PM<br>
<b>To:</b> Archivesspace Users Group <archivesspace_users_group@lyralists.lyrasis.org><br>
<b>Subject:</b> Re: [Archivesspace_Users_Group] log4j vulnerability in ArchivesSpace?</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_x_MsoNormal, li.x_x_MsoNormal, div.x_x_MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_x_MsoHyperlink
{color:blue;
text-decoration:underline}
span.x_x_EmailStyle19
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
-->
</style>
<div lang="EN-US" style="word-wrap:break-word">
<div class="x_x_WordSection1">
<p class="x_x_MsoNormal">Are people on earlier versions of ArchivesSpace , e.g. 2.7.1 that use archivesspace’s internal solr vulnerable?</p>
<p class="x_x_MsoNormal"> </p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_x_MsoNormal"><b>From:</b> archivesspace_users_group-bounces@lyralists.lyrasis.org <archivesspace_users_group-bounces@lyralists.lyrasis.org>
<b>On Behalf Of </b>Peter Heiner<br>
<b>Sent:</b> Saturday, December 11, 2021 9:00 AM<br>
<b>To:</b> Archivesspace Users Group <archivesspace_users_group@lyralists.lyrasis.org><br>
<b>Subject:</b> Re: [Archivesspace_Users_Group] log4j vulnerability in ArchivesSpace?</p>
</div>
</div>
<p class="x_x_MsoNormal"> </p>
<div>
<p class="x_x_MsoNormal">While ArchivesSpace itself might not be vulnerable, those who run an extrrnal Solr instance should be aware that it itself may be, see <a href="https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228">https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228</a>
for more information and some possible workarounds.</p>
</div>
<div>
<p class="x_x_MsoNormal"> </p>
</div>
<div>
<p class="x_x_MsoNormal">p</p>
</div>
<div class="x_x_MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_x_divRplyFwdMsg">
<p class="x_x_MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black">
<a href="mailto:archivesspace_users_group-bounces@lyralists.lyrasis.org">archivesspace_users_group-bounces@lyralists.lyrasis.org</a> <<a href="mailto:archivesspace_users_group-bounces@lyralists.lyrasis.org">archivesspace_users_group-bounces@lyralists.lyrasis.org</a>>
on behalf of Tom Hanstra <<a href="mailto:hanstra@nd.edu">hanstra@nd.edu</a>><br>
<b>Sent:</b> 11 December 2021 13:21<br>
<b>To:</b> Archivesspace Users Group <<a href="mailto:archivesspace_users_group@lyralists.lyrasis.org">archivesspace_users_group@lyralists.lyrasis.org</a>><br>
<b>Subject:</b> [Archivesspace_Users_Group] log4j vulnerability in ArchivesSpace?</span>
</p>
<div>
<p class="x_x_MsoNormal"> </p>
</div>
</div>
<div>
<div>
<div>
<p class="x_x_MsoNormal">There is a lot of buzz right now about the log4j exploit being used against Java applications. Does anyone know if ArchivesSpace is vulnerable to these exploits? </p>
</div>
<div>
<p class="x_x_MsoNormal"> </p>
</div>
<div>
<p class="x_x_MsoNormal">Tom</p>
</div>
<p class="x_x_MsoNormal">-- </p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="x_x_MsoNormal"><b><span style="font-size:9.5pt; font-family:"Arial",sans-serif; color:#888888">Tom Hanstra</span></b></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="x_x_MsoNormal"><i><span style="font-size:9.5pt; font-family:"Arial",sans-serif; color:#888888">Sr. Systems Administrator</span></i><span style="font-size:9.5pt; color:#888888"></span></p>
</div>
<div>
<p class="x_x_MsoNormal"><span style="font-size:9.5pt; color:#888888"><a href="mailto:hanstra@nd.edu" target="_blank"><span style="font-family:"Arial",sans-serif; color:#1155CC">hanstra@nd.edu</span></a></span></p>
</div>
</div>
<div>
<p class="x_x_MsoNormal"><span style="font-size:9.5pt; color:#888888"> </span></p>
</div>
</div>
<div>
<p class="x_x_MsoNormal"><span style="font-size:9.5pt; color:#888888"><img border="0" width="276" height="30" id="x_x__x0000_i1026" style="width:2.875in; height:.3125in" src="https://docs.google.com/uc?export=download&id=1GFX1KaaMTtQ2Kg2u8bMXt1YwBp96bvf0&revid=0B7APN9POn6xAQ244WWFYMFU3aVJwZ0lxbmVHK3FxNXlCd0RRPQ"></span><span style="font-size:9.5pt; color:#888888"></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<span>_______________________________________________</span><br>
<span>Archivesspace_Users_Group mailing list</span><br>
<span>Archivesspace_Users_Group@lyralists.lyrasis.org</span><br>
<span>http://lyralists.lyrasis.org/mailman/listinfo/archivesspace_users_group</span><br>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Is e buidheann carthannais a th’ ann an Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh clàraidh SC005336.
</body>
</html>