This is a summary and analysis of Acquia’s response to the log4j vulnerability (CVE-2021-44228). Any remaining issues or risks are identified, as are recommended or pending actions.
On December 10th, 2021, Acquia was made aware of a security vulnerability in the Apache log4j logging utility. Acquia immediately investigated and determined that Acquia Search with Solr 7 was the only customer-accessible Acquia product impacted by the log4j vulnerability, CVE-2021-44228.
Due to the nature of this security vulnerability, Acquia chose to deactivate all possible susceptible search services while investigation and remediation took place in order to protect all Acquia customers and their data. This action was taken with knowledge that it could adversely impact applications and occurred with approval from all executive stakeholders given the potential risk of remote code execution. In most cases, the impact to applications was that search requests resulted in errors being returned. In some cases, applications may not have been able to ‘fail gracefully’ when search requests resulted in errors or where connections to search services resulted in requests being unable to timeout. Acquia seeks to maintain a stable and secure platform. In this case, the total security of all customer applications and customer data was required to take precedent over all other considerations.
Testing by Acquia security personnel found that in many cases Drupal and/or its associated modules prevented exploitation. Acquia ensured that the vulnerability was mitigated fully before reactivating the affected search services.
Further patching of log4j to version 2.16.0 was conducted 16 December. This maintenance was also conducted on an urgent basis; however, review of data during this second round of actions for all search infrastructure indicated that no interruption of service took place and impact was minimal across all systems.
No Acquia hosting platform (Acquia Cloud Enterprise both Classic and Next, Acquia Cloud Site Factory, and Acquia Cloud Professional) makes use of Java and thus does not directly make any use of log4j.
Acquia has, further, consulted with all 3rd party vendors to confirm that all systems for those vendors have also been mitigated for CVE-2021-44228.
As a standard practice, Acquia recommends that customers design their applications and all associated forms that accept input from users to evaluate and sanitize all input. Acquia evaluates and implements mitigations to known vulnerabilities according to our security policies and reminds all customers that security is a shared responsibility between the platform and applications.
All times UTC
2021-12-10
2021-12-11
Acquia published the following knowledge base article to provide continuing updates as Acquia security team members continued to evaluate information regarding the log4j vulnerability.
2021-12-15
2021-12-16