Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

A critical vulnerability was identified in Log4j 2.0+. It’s a Java logging library used by most Java based applications and the vulnerability affects most products around the world. It can be exploited easily through a simple HTTP request that is logged can lead to a remote code execution and we recommend everyone take immediate action to address the issue. 

Liferay DXP and Portal

Liferay DXP and Portal 7.4 are impacted by vulnerability CVE-2021-44228 and can be exploited. As a mitigation step, we ask all of our customers using this version to set this JVM parameter below to mitigate the attack:

-Dlog4j2.formatMsgNoLookups=true

Note: The Liferay DXP 7.4 DXP Update 1 and Liferay Portal 7.4 GA5 will contain the updated version of Log4j which addresses this vulnerability (2.15.0).

Liferay DXP and Portal 7.3 and below are not affected by the Log4j2 vulnerability reported under CVE-2021-44228 as these versions use a version of Log4j which did not include the problematic code changes. Some of our Marketplace applications (like Connector to Elasticsearch 6/7) contain a vulnerable version of Log4j2, however due to the limited scope of the products and the type of logging, we couldn’t identify ways this vulnerability could be used to attack Liferay systems. We are working on updating Log4j versions in all of our products regardless.

Custom modules, plugins and extensions - We recommend our customers to audit their code base. If they find a use of the vulnerable library they are advised to apply the mitigation as soon as possible, upgrade Log4j version to 2.15.0 and deploy changes to all live environments, production and non-production.

Liferay SaaS

Liferay SaaS applications and infrastructure are not impacted by the vulnerability.

Liferay Cloud Services

Following services are not impacted by the vulnerability, they don’t depend on the vulnerable library:

• liferaycloud/backup

• liferaycloud/database

• liferaycloud/jenkins

• liferaycloud/nginx

• liferaycloud/vpn

Liferay DXP 7.4 (liferaycloud/liferay-dxp, liferaycloud/liferay-portal) - We are working with any customers running Liferay DXP 7.4 to mitigate the vulnerability in their environments. Customers running DXP 7.3 or below are not impacted.

Elasticsearch (liferaycloud/elasticsearch, liferaycloud/elasticsearch-api) - The ES products might be affected, however there’s no known way of using this vulnerability through the Liferay service. We are waiting for Elastic’s response and fix to release the updated images on Liferay DXP Cloud.

Custom services not provided by Liferay Cloud - We strongly advise customers to review their custom Java applications.

Liferay Enterprise Search

Elasticsearch and Liferay Enterprise Search Security Advisory: Dec 11, 2021 (CVE-2021-44228)