{"id":"INC-qubole-swzv3fb1mp8z","kind":"incident","aliases":[],"related":[],"title":"Qubole: Log4J Issue (CVE-2021-44228)","description":"Qubole’s investigation of the CVE-2021-44228 vulnerability in the Apache Log4j library continues to advance, with focus on identifying any exposed instance of a vulnerable Apache Log4j library as per Apache’s public updates.  Qubole consists of two parts: (1) the Control Plane, which resides on Qubole-controlled hardware and (2) the Data Plane, which resides on Customer-controlled hardware.  The investigation is guided by this structure.\n\nWithin the Control Plane (on Qubole-controlled hardware), our investigation confirmed there are no exposed instances of the Apache Log4j library within the version range that contains this vulnerability. Therefore, the investigation confidently concludes the Control Plane is not impacted by the Apache Log4j vulnerability.  \n\nFor the Data Plane (on Customer-controlled hardware), we understand Qubole customers will want to take immediate action to protect the environments they control.  This immediate action can be achieved by following the mitigation instructions as published by Apache on the Apache website (https://logging.apache.org/log4j/2.x/security.html).\n\nAlthough our initial and thorough investigation has concluded, and Qubole continues to monitor for potential breaches, we will continue actively to monitor this situation and communicate with stakeholders as appropriate.","summary":"Qubole reported that its own hosted control plane contains no vulnerable Apache Log4j library, so it is not impacted by CVE-2021-44228. Customer-run data plane components can still contain the vulnerable library and need the mitigation Apache publishes.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Qubole","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","java","log4j","qubole","security","self-hosted","vendor"],"not_affected_if":["control-plane-only","managed-hosting"],"how_to_check":"- Check the Apache Log4j version in your Qubole data plane (customer-controlled hardware) against the Apache Log4j security page: https://logging.apache.org/log4j/2.x/security.html","fix":"- Follow the mitigation instructions Apache publishes at https://logging.apache.org/log4j/2.x/security.html for customer-controlled data plane environments\n- No fixed version is stated by the Qubole source","status":"resolved","published_at":"2021-12-14T20:39:48+00:00","first_seen_at":"2026-11-09T17:16:52+00:00","triaged_at":"2026-11-09T17:18:19+00:00","updated_at":"2026-11-09T17:18:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-09T17:18:19Z","model":"claude-haiku-5-5","output":{"fix":"- Follow the mitigation instructions Apache publishes at https://logging.apache.org/log4j/2.x/security.html for customer-controlled data plane environments\n- No fixed version is stated by the Qubole source","reach":"unknown","title":"Qubole: Log4j Log4Shell flaw found; control plane not affected","impact":"high","summary":"Qubole reported that its own hosted control plane contains no vulnerable Apache Log4j library, so it is not impacted by CVE-2021-44228. Customer-run data plane components can still contain the vulnerable library and need the mitigation Apache publishes.","audience":"businesses","category":"vendor","nicknames":["Log4Shell"],"who_cares":["qubole","log4j","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm the affected Data Plane versions and the exact Log4j fix from the Qubole statuspage and Apache's security page.","how_to_check":"- Check the Apache Log4j version in your Qubole data plane (customer-controlled hardware) against the Apache Log4j security page: https://logging.apache.org/log4j/2.x/security.html\n- unknown for exact versions and affected components, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["control-plane-only","managed-hosting"],"who_is_affected":"Qubole's hosted Control Plane is stated not to be affected. Customers who run the Data Plane on their own hardware should check their Apache Log4j usage and apply Apache's published mitigation. The sources do not list exact affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000795,"input_tokens":4875,"output_tokens":614,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2021':5A,42B,68C '-44228':6A,43B,69C '/log4j/2.x/security.html).':225C '1':103C '2':115C 'achiev':209C 'action':197C,206C 'activ':245C 'advanc':78C 'although':226C 'apach':32B,60B,73C,89C,94C,152C,176C,218C,221C 'appropri':255C 'breach':241C 'communic':251C 'compon':49B 'conclud':167C,233C 'confid':166C 'confirm':144C 'consist':99C 'contain':29B,52B,160C 'continu':76C,236C,244C 'control':27B,105C,112C,124C,135C,140C,169C,186C,203C 'custom':45B,123C,185C,191C 'customer-control':122C,184C 'customer-run':44B 'cve':4A,41B,67C 'data':47B,117C,181C 'environ':201C 'expos':84C,148C 'focus':80C 'follow':211C 'guid':129C 'hardwar':113C,125C,141C,187C 'host':19B,26B 'identifi':82C 'immedi':196C,205C 'impact':39B,173C 'inc':8A 'inc-qubole-swzv3fb1mp8z':7A 'incid':12B 'initi':228C 'instanc':85C,149C 'instruct':214C 'investig':64C,127C,143C,165C,231C 'issu':3A 'java':13B 'librari':34B,55B,75C,91C,154C 'log4j':2A,14B,33B,74C,90C,153C,177C 'logging.apache.org':224C 'logging.apache.org/log4j/2.x/security.html).':223C 'mitig':59B,213C 'monitor':238C,247C 'need':57B 'part':102C 'per':93C 'plane':28B,48B,106C,118C,136C,170C,182C 'potenti':240C 'protect':199C 'public':96C 'publish':61B,216C 'qubol':1A,15B,21B,62C,98C,111C,139C,190C,235C 'qubole':9A,11A 'qubole-control':110C,138C 'rang':158C 'report':22B 'resid':108C,120C 'run':46B 'secur':16B 'self':18B 'self-host':17B 'situat':249C 'stakehold':253C 'still':51B 'structur':132C 'swzv3fb1mp8z':10A 'take':195C 'therefor':163C 'thorough':230C 'two':101C 'understand':189C 'updat':97C 'vendor':20B 'version':157C 'vulner':31B,54B,70C,88C,162C,178C 'want':193C 'websit':222C 'within':133C,155C","nicknames":["Log4Shell"],"mitigations":[],"who_affected":"Qubole's hosted Control Plane is stated not to be affected. Customers who run the Data Plane on their own hardware should check their Apache Log4j usage and apply Apache's published mitigation. The sources do not list exact affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["log4shell","qubole"],"ptokens":["qubole"],"labels":["incident","java","log4j","low","qubole","security","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2021':5A '-44228':6A 'cve':4A 'inc':8A 'inc-qubole-swzv3fb1mp8z':7A 'issu':3A 'log4j':2A 'qubol':1A 'qubole':9A,11A 'swzv3fb1mp8z':10A","search_b":"'-2021':42B '-44228':43B 'apach':32B,60B 'compon':49B 'contain':29B,52B 'control':27B 'custom':45B 'customer-run':44B 'cve':41B 'data':47B 'host':19B,26B 'impact':39B 'incid':12B 'java':13B 'librari':34B,55B 'log4j':14B,33B 'mitig':59B 'need':57B 'plane':28B,48B 'publish':61B 'qubol':15B,21B 'report':22B 'run':46B 'secur':16B 'self':18B 'self-host':17B 'still':51B 'vendor':20B 'vulner':31B,54B","search_c":"'-2021':68C '-44228':69C '/log4j/2.x/security.html).':225C '1':103C '2':115C 'achiev':209C 'action':197C,206C 'activ':245C 'advanc':78C 'although':226C 'apach':73C,89C,94C,152C,176C,218C,221C 'appropri':255C 'breach':241C 'communic':251C 'conclud':167C,233C 'confid':166C 'confirm':144C 'consist':99C 'contain':160C 'continu':76C,236C,244C 'control':105C,112C,124C,135C,140C,169C,186C,203C 'custom':123C,185C,191C 'customer-control':122C,184C 'cve':67C 'data':117C,181C 'environ':201C 'expos':84C,148C 'focus':80C 'follow':211C 'guid':129C 'hardwar':113C,125C,141C,187C 'identifi':82C 'immedi':196C,205C 'impact':173C 'initi':228C 'instanc':85C,149C 'instruct':214C 'investig':64C,127C,143C,165C,231C 'librari':75C,91C,154C 'log4j':74C,90C,153C,177C 'logging.apache.org':224C 'logging.apache.org/log4j/2.x/security.html).':223C 'mitig':213C 'monitor':238C,247C 'part':102C 'per':93C 'plane':106C,118C,136C,170C,182C 'potenti':240C 'protect':199C 'public':96C 'publish':216C 'qubol':62C,98C,111C,139C,190C,235C 'qubole-control':110C,138C 'rang':158C 'resid':108C,120C 'situat':249C 'stakehold':253C 'structur':132C 'take':195C 'therefor':163C 'thorough':230C 'two':101C 'understand':189C 'updat':97C 'version':157C 'vulner':70C,88C,162C,178C 'want':193C 'websit':222C 'within':133C,155C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2021-12-14T20:39:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"qubole:swzv3fb1mp8z","url":"https://stspg.io/v0712908tfz5","severity":"low","published_at":"2021-12-14T20:39:48+00:00","modified_at":"2021-12-16T14:39:20+00:00","first_seen_at":"2026-11-09T17:16:52+00:00","fetched_at":"2026-11-09T17:55:23+00:00","note":null}],"documents":[{"id":20680,"url":"https://www.aikido.dev/blog/what-are-shell-vulnerabilities","title":"Aikido: What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained","kind":"blog","source":"blog","publisher":null,"text":"What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained\n\nWe explain what shell vulnerabilities are and how to manage them: PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell Category: Guides & Best Practices","published_at":"2026-10-29T19:07:00+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}