log4j vulnerability in OmniStack itself?

[elange]

Hello,

i am a bit curious as there is only the thread about the vcenter here in the forum.

According to security bulletin hpesbgn04215en_us it seems all OmniStacks versions are affected from this issue.

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04215en_us

Sure, there must be some kind of word or workaround about it?

Hoping for the workaround instructions. Change the log4j config if required in the OmniStack and restart the service?

Am i just missing the correct thread?

Still several weeks before we can get rid of the legacy Hardware ...

Regards,

El

[support_s]

System recommended content:

1. HPE Ezmeral Container Platform: Log4j vulnerability impact of CVE-2021-44228 and CVE-2021-45046 on HPE Ezmeral Container Platform

If the above information is helpful, then please click on "Thumbs Up/Kudo" icon.

Thank you for being a HPE community member.

[elange]

So are you saying that inside every omnistack there is an Ezmeral Container Plattform running?

How would one access the container running inside the OmniStack VM Ezmeral Container Plattform?

[Sjoerd2106]

I also think that there should be more transparency from HPE about the way SimpliVity is affected by the log4j bug is and what steps will be taken to mitigate the issue for SimpliVity.

[Parvez_Admin]

Hello,

I would recommend to directly contact technical support and log a support call for more clarity on this. Please refer the links below for support ticket options:

https://support.hpe.com/help/en/Content/supportAndOtherResources.html

https://www.hpe.com/psnow/doc/A00039121ENW

[Sjoerd2106]

HPE has a Security Bulletin with all affected software for log4j:

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04215en_us

SimpliVity is on that list. There is is also a specific SimpliVity support alert if you at the above page:

https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-a00120260en_us

So, it seems that SimpliVity is affected by the log4j bug, because vCenter is affected. That seems logical, because you need vCenter for managing SimpliVIty.

But how difficult can it be to add a few lines to the above article that the other SimpliVity software components (like the OVC's) are not affected by the log4j bug? It would prevent a lot of support tickets towards HPE.

[MikeSeden]

After much effort by our supporting engineers it was decided that the VMware vCenter patch for the  log4j security problem is acceptable and compatable. SimpliVity is NOT affected, as SimpliVity does not use log4j . The VMware OS that is being used with the SimpliVity was what was affected. The SimpliVity configurations were put on the security bulletin for that reason.

Applying the VMware vCenter patch is the SimpliVity solution to ther Apache log4j(*) security issues.