QUBOLE · Vendor
NO FIX YET · SEE WHAT TO DO
Qubole reported that its own hosted control plane contains no vulnerable Apache Log4j library, so it is not impacted by CVE-2021-44228. Customer-run data plane components can still contain the vulnerable library and need the mitigation Apache publishes.
first public Dec 14, 2021 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Qubole's hosted Control Plane is stated not to be affected. Customers who run the Data Plane on their own hardware should check their Apache Log4j usage and apply Apache's published mitigation. The sources do not list exact affected versions.
Not affected if control-plane-only, managed-hosting
Who cares java, log4j, qubole, security, self-hosted
Qubole’s investigation of the CVE-2021-44228 vulnerability in the Apache Log4j library continues to advance, with focus on identifying any exposed instance of a vulnerable Apache Log4j library as per Apache’s public updates. Qubole consists of two parts: (1) the Control Plane, which resides on Qubole-controlled hardware and (2) the Data Plane, which resides on Customer-controlled hardware. The investigation is guided by this structure.
Within the Control Plane (on Qubole-controlled hardware), our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. Therefore, the investigation confidently concludes the Control Plane is not impacted by the Apache Log4j vulnerability.
For the Data Plane (on Customer-controlled hardware), we understand Qubole customers will want to take immediate action to protect the environments they control. This immediate action can be achieved by following the mitigation instructions as published by Apache on the Apache website (https://logging.apache.org/log4j/2.x/security.html).
Although our initial and thorough investigation has concluded, and Qubole continues to monitor for potential breaches, we will continue actively to monitor this situation and communicate with stakeholders as appropriate.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.