topic Re: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)? in HPE OneView

Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)?

daax — Tue, 14 Dec 2021 04:47:14 GMT

As title says, I'm looking to determine if the OneView or OneView Global Dashboard appliances (And iLO interfaces for that matter) are vulnerable to the Log4j vulnerability.

I chatted with HPE support, but was not confident in their answer. They directed me to this webpage (https://www.hpe.com/us/en/services/security-vulnerability.html) and said OneVeiw is not listed, so that means its not vulnerable. However, no products are listed on that page, so I was looking for a little more positive confirmation that OneVeiw is not vulnerable. Anyone know for certian?

Query: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)?

support_s — Mon, 13 Dec 2021 22:45:55 GMT

System recommended content:

1. Notice: Apache Software Log4j - Security Vulnerability CVE-2021-44228

2. Is NonStop system vulnerable to CVE-2021-44228?

If the above information is helpful, then please click on "Thumbs Up/Kudo" icon.

Thank you for being a HPE community member.

Re: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)?

ChrisLynch — Mon, 13 Dec 2021 22:55:12 GMT

HPE OneView and OneView Global Dashboard are not vulnerable to the log4j exploit. While both use log4j, it is an older version without the exploit and does not allow an external attacker access to its endpoint (it is restricted to internal authenticated services only).

iLO does not use log4j at all, in any firmware version for any generation of ASIC.

Re: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)?

daax — Tue, 14 Dec 2021 16:05:55 GMT

Thank you!

Re: Query: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-4422

daax — Tue, 14 Dec 2021 16:06:32 GMT

Thank you!

Re: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)?

cesarpegado — Wed, 15 Dec 2021 09:17:14 GMT

Just a quick question, you said iLO doesn't use Log4j, But i was under the impression that HPE are currently making a new iLO version to fix this, am I wrong?

Re: Is OneView vulnerable to the Apache Software Log4j Vulnerability (CVE-2021-44228)?

ChrisLynch — Wed, 15 Dec 2021 16:10:54 GMT

Just a quick question, you said iLO doesn't use Log4j, But i was under the impression that HPE are currently making a new iLO version to fix this, am I wrong?

I'm not sure where you recieved that information from, but iLO is not impacted by CVE-2021-44228. We document major vulnerabilities here. The specific details to CVE-2021-44228 here. You will see that iLO4 and iLO5 are in the not vulnerable list, here. We are looking to amend the list to include all versions of iLO.