SCA-2021-0003
Vulnerability from csaf_sick
Published
2021-12-14 17:00
Modified
2021-12-17 12:00
Summary
SICK Security Advisory for Apache Log4j (CVE-2021-44228)

Notes

General Security Measures
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
Vulnerability Classification
SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.


To clipboard 

{
   document: {
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en-US",
      notes: [
         {
            category: "general",
            text: "As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.",
            title: "General Security Measures",
         },
         {
            category: "general",
            text: "SICK performs vulnerability classification by using the CVSS scoring system (*CVSS v3.1*). The environmental score is dependent on the customer’s environment and can affect the overall CVSS score. SICK recommends that customers individually evaluate the environmental score to achieve final scoring.",
            title: "Vulnerability Classification",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "psirt@sick.de",
         issuing_authority: "SICK PSIRT is responsible for any vulnerabilities related to SICK products.",
         name: "SICK PSIRT",
         namespace: "https://sick.com/psirt",
      },
      references: [
         {
            summary: "SICK PSIRT Security Advisories",
            url: "https://sick.com/psirt",
         },
         {
            summary: "SICK Operating Guidelines",
            url: "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
         },
         {
            summary: "ICS-CERT recommended practices on Industrial Security",
            url: "http://ics-cert.us-cert.gov/content/recommended-practices",
         },
         {
            summary: "CVSS v3.1 Calculator",
            url: "https://www.first.org/cvss/calculator/3.1",
         },
         {
            category: "self",
            summary: "The canonical URL.",
            url: "https://www.sick.com/.well-known/csaf/white/2021/sca-2021-0003.json",
         },
      ],
      title: "SICK Security Advisory for Apache Log4j (CVE-2021-44228)",
      tracking: {
         aliases: [
            "LOG4SHELL",
         ],
         current_release_date: "2021-12-17T12:00:00.000Z",
         generator: {
            date: "2023-02-10T07:41:23.369Z",
            engine: {
               name: "Secvisogram",
               version: "2.0.0",
            },
         },
         id: "SCA-2021-0003",
         initial_release_date: "2021-12-14T17:00:00.000Z",
         revision_history: [
            {
               date: "2021-12-14T17:00:00.000Z",
               number: "1",
               summary: "Initial Release",
            },
            {
               date: "2021-12-16T17:00:00.000Z",
               number: "2",
               summary: "Updated affected products",
            },
            {
               date: "2021-12-17T12:00:00.000Z",
               number: "3",
               summary: "Updated affected versions",
            },
            {
               date: "2022-01-14T13:00:00.000Z",
               number: "4",
               summary: "Updated affected products",
            },
            {
               date: "2022-01-19T11:00:00.000Z",
               number: "5",
               summary: "Updated affected products",
            },
            {
               date: "2022-02-17T11:00:00.000Z",
               number: "6",
               summary: "Updated affected products",
            },
            {
               date: "2023-02-10T11:00:00.000Z",
               number: "7",
               summary: "Updated Advisory (only visual changes)",
            },
         ],
         status: "final",
         version: "7",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<1.5.3",
                        product: {
                           name: "SICK FieldEcho <1.5.3",
                           product_id: "CSAFPID-0001",
                           product_identification_helper: {
                              skus: [
                                 "1612993",
                              ],
                              x_generic_uris: [
                                 {
                                    namespace: "SICK:Website",
                                    uri: "SICK:Website:https://www.sick.com/de/de/p/p597264",
                                 },
                              ],
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "FieldEcho",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<1.4.1",
                        product: {
                           name: "SICK Function Block Factory <1.4.1",
                           product_id: "CSAFPID-0002",
                           product_identification_helper: {
                              x_generic_uris: [
                                 {
                                    namespace: "SICK:Website",
                                    uri: "SICK:Website:https://www.sick.com/de/de/p/p653518",
                                 },
                              ],
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "Function Block Factory",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<1.5.0",
                        product: {
                           name: "SICK AppManager <1.5.0",
                           product_id: "CSAFPID-0003",
                           product_identification_helper: {
                              x_generic_uris: [
                                 {
                                    namespace: "SICK:Website",
                                    uri: "SICK:Website:https://www.sick.com/de/de/p/p532784",
                                 },
                              ],
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "AppManager",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<1.2.2",
                        product: {
                           name: "SICK FieldEcho Dashboard <1.2.2",
                           product_id: "CSAFPID-0004",
                           product_identification_helper: {
                              x_generic_uris: [
                                 {
                                    namespace: "SICK:Website",
                                    uri: "SICK:Website:https://www.sick.com/de/de/p/p651603",
                                 },
                              ],
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "FieldEcho Dashboard",
               },
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<3.6.0",
                        product: {
                           name: "SICK AppStudio <3.6.0",
                           product_id: "CSAFPID-0005",
                           product_identification_helper: {
                              skus: [
                                 "1610199",
                              ],
                              x_generic_uris: [
                                 {
                                    namespace: "SICK:Website",
                                    uri: "SICK:Website:https://www.sick.com/de/de/p/p448644",
                                 },
                              ],
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "AppStudio",
               },
            ],
            category: "vendor",
            name: "SICK AG",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-44228",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         notes: [
            {
               category: "summary",
               text: "A critical remote code execution vulnerability impacting at least Apache Log4j 2 (versions 2.0 to 2.14.1) was recently announced by Apache. This vulnerability is designated by Mitre as CVE-2021-44228 with the highest severity rating of 10.0. The vulnerability is also known as Log4Shell by security \nresearchers. If exploited, this vulnerability allows adversaries to potentially take full control of the impacted system.\nLog4j 2 is a commonly used open source third party Java logging library used in software applications and services.",
               title: "Summary",
            },
         ],
         product_status: {
            fixed: [
               "CSAFPID-0001",
               "CSAFPID-0002",
               "CSAFPID-0003",
               "CSAFPID-0004",
               "CSAFPID-0005",
            ],
         },
         references: [
            {
               category: "external",
               summary: "Apache Security Advisory",
               url: "https://logging.apache.org/log4j/2.x/security.html",
            },
            {
               category: "external",
               summary: "CVE Entry",
               url: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "Fixed on vendorside",
               product_ids: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
                  "CSAFPID-0003",
                  "CSAFPID-0004",
                  "CSAFPID-0005",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 10,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "CSAFPID-0001",
                  "CSAFPID-0002",
                  "CSAFPID-0003",
                  "CSAFPID-0004",
               ],
            },
         ],
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.