{"id":62193,"date":"2021-12-14T19:45:08","date_gmt":"2021-12-15T01:45:08","guid":{"rendered":"https:\/\/blog.cpanel.com\/?p=62193"},"modified":"2021-12-14T19:45:08","modified_gmt":"2021-12-15T01:45:08","slug":"the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server","status":"publish","type":"post","link":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/","title":{"rendered":"The Apache Log4j exploit and how to protect your cPanel server"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">On Friday, December 10, 2021, a vulnerability for Log4j was announced in&nbsp;<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44228\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-44228<\/a>.&nbsp;&nbsp;<\/h2>\n\n\n\n<p><a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/index.html\" target=\"_blank\" rel=\"noreferrer noopener\">Log4j<\/a>&nbsp;is developed by the Apache Foundation and is widely used by both enterprise apps and cloud services.&nbsp;It&nbsp;was&nbsp;<a href=\"https:\/\/www.cyberkendra.com\/2021\/12\/worst-log4j-rce-zeroday-dropped-on.html\" target=\"_blank\" rel=\"noreferrer noopener\">reported by Alibaba Cloud&#8217;s security team<\/a>&nbsp;to Apache on November 24.&nbsp;They also revealed that CVE-2021-44228 impacts default configurations of multiple Apache frameworks, including Apache Struts2, Apache&nbsp;Solr, Apache Druid, Apache Flink, and others.&nbsp;The United States&nbsp;Cybersecurity and Infrastructure Security Agency&nbsp;also issued a statement from CISA Director Easterly on the log4j vulnerability.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How does this impact my cPanel server?&nbsp;<\/h3>\n\n\n\n<p>The same day the vulnerability was announced, we published an update with the mitigation for&nbsp;CVE-2021-44228 to the&nbsp;cpanel-dovecot-solr&nbsp;RPM in version 8.8.2-4+. The only service provided by the cPanel software that uses the logging utility Log4j is&nbsp;cpanel-dovecot-solr. If you do not have this installed, then your server is secure.&nbsp;This patch will automatically be applied during the nightly updates if this package is installed. On new installations of&nbsp;Dovecot_FTS&nbsp;it will include the patched RPM by default.&nbsp;You can join the discussion&nbsp;on the cPanel Forums&nbsp;<a href=\"https:\/\/forums.cpanel.net\/threads\/log4j-cve-2021-44228-does-it-affect-cpanel.696249\/\" target=\"_blank\" rel=\"noreferrer noopener\">log4j-cve-2021-44228 thread.<\/a> You can check if this RPM is installed by running the command below. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">On RPM based versions&nbsp;<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\">#&nbsp;rpm&nbsp;-q&nbsp;cpanel-dovecot-solr&nbsp;--changelog | grep&nbsp;CVE-2021-44228&nbsp;&nbsp;<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">On Ubuntu based versions&nbsp;<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\">#&nbsp;zgrep&nbsp;-E&nbsp;CVE-2021-44228 \/usr\/share\/doc\/cpanel-dovecot-solr\/changelog.Debian.gz&nbsp;&nbsp;<\/pre>\n\n\n\n<p>Example if installed:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">#&nbsp;rpm&nbsp;-q&nbsp;cpanel-dovecot-solr&nbsp;&nbsp;<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">cpanel-dovecot-solr-8.8.2-4.11.1.cpanel.noarch&nbsp;<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Additional Information&nbsp;<\/h3>\n\n\n\n<p>Our Technical Support team has also published a knowledge base article regarding the Log4j vulnerability titled&nbsp;<a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/4415775520919-ApacheSolr-vulnerability-CVE-2021-44228-for-Log4j\" target=\"_blank\" rel=\"noreferrer noopener\">ApacheSolr&nbsp;vulnerability&nbsp;CVE-2021-44228&nbsp;for&nbsp;Log4j.<\/a>&nbsp;If you have any additional questions or need further assistance, please open a ticket at&nbsp;<a href=\"https:\/\/support.cpanel.net\/\" target=\"_blank\" rel=\"noreferrer noopener\">support.cpanel.net.<\/a>&nbsp;&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Update for December 15, 2021&nbsp;<\/h3>\n\n\n\n<p>The Apache Logging team released an update after it was discovered&nbsp;that&nbsp;certain non-default configurations were still vulnerable&nbsp;to the log4j exploit.&nbsp;We released an updated&nbsp;patch with&nbsp;additional mitigation into our&nbsp;cpanel-dovecot-solr.&nbsp;<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-45046\" target=\"_blank\" rel=\"noreferrer noopener\">Learn more about CVE-2021-45046.<\/a>&nbsp;You can also read the&nbsp;<a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\" target=\"_blank\" rel=\"noreferrer noopener\">Apache Logging site&#8217;s Security page<\/a>&nbsp;for more information.&nbsp;&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">References:&nbsp;<\/h4>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare\/\" target=\"_blank\" rel=\"noreferrer noopener\">New Zero Day Exploit for log4j Java Library is an Enterprise Nightmare (Bleeping Computer)<\/a>&nbsp;<\/li><li><a href=\"https:\/\/solr.apache.org\/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228\" target=\"_blank\" rel=\"noreferrer noopener\">Apache Solr Affected by Apache log4j-cve-2021-44228&nbsp;<\/a>&nbsp;<\/li><li><a href=\"https:\/\/forums.cpanel.net\/threads\/log4j-cve-2021-44228-does-it-affect-cpanel.696249\/\" target=\"_blank\" rel=\"noreferrer noopener\">cPanel Community Forums logj4-cve-2021-44228 thread<\/a>&nbsp;&nbsp;<\/li><li><a href=\"https:\/\/www.zdnet.com\/article\/second-log4j-vulnerability-found-apache-log4j-2-16-0-released\/\" target=\"_blank\" rel=\"noreferrer noopener\">Second Log4j vulnerability discovered, patch already released<\/a>&nbsp;<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>On Friday, December 10, 2021, a vulnerability for Log4j was announced in&nbsp;CVE-2021-44228.&nbsp;&nbsp; Log4j&nbsp;is developed by the Apache Foundation and is widely used by both enterprise apps and cloud services.&nbsp;It&nbsp;was&nbsp;reported by Alibaba Cloud&#8217;s security team&nbsp;to Apache on November 24.&nbsp;They also revealed that CVE-2021-44228 impacts default configurations of multiple Apache frameworks, including Apache Struts2, Apache&nbsp;Solr, Apache Druid, [&hellip;]<\/p>\n","protected":false},"author":85,"featured_media":65857,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[293,49,2281],"tags":[601,801,1801,1221,2285],"class_list":["post-62193","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-announcements","category-products","category-security","tag-apache","tag-dovecot","tag-security","tag-server-security","tag-solr"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>The Apache Log4j exploit and how to protect your cPanel server | cPanel<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Apache Log4j exploit and how to protect your cPanel server | cPanel\" \/>\n<meta property=\"og:description\" content=\"On Friday, December 10, 2021, a vulnerability for Log4j was announced in&nbsp;CVE-2021-44228.&nbsp;&nbsp; Log4j&nbsp;is developed by the Apache Foundation and is widely used by both enterprise apps and cloud services.&nbsp;It&nbsp;was&nbsp;reported by Alibaba Cloud&#8217;s security team&nbsp;to Apache on November 24.&nbsp;They also revealed that CVE-2021-44228 impacts default configurations of multiple Apache frameworks, including Apache Struts2, Apache&nbsp;Solr, Apache Druid, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/\" \/>\n<meta property=\"og:site_name\" content=\"cPanel\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cpanel\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-15T01:45:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/devel.www.cpanel.net\/wp-content\/uploads\/2021\/12\/The-Apache-Log4J-Exploit-blog-header.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"475\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Tabby Worthington\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cPanel\" \/>\n<meta name=\"twitter:site\" content=\"@cPanel\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tabby Worthington\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/\",\"url\":\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/\",\"name\":\"The Apache Log4j exploit and how to protect your cPanel server | cPanel\",\"isPartOf\":{\"@id\":\"https:\/\/devel.www.cpanel.net\/#website\"},\"datePublished\":\"2021-12-15T01:45:08+00:00\",\"dateModified\":\"2021-12-15T01:45:08+00:00\",\"author\":{\"@id\":\"https:\/\/devel.www.cpanel.net\/#\/schema\/person\/937065f5d955e1a72a1abd851bbb5a0c\"},\"breadcrumb\":{\"@id\":\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/devel.www.cpanel.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Apache Log4j exploit and how to protect your cPanel server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/devel.www.cpanel.net\/#website\",\"url\":\"https:\/\/devel.www.cpanel.net\/\",\"name\":\"cPanel\",\"description\":\"Hosting Platform of Choices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/devel.www.cpanel.net\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/devel.www.cpanel.net\/#\/schema\/person\/937065f5d955e1a72a1abd851bbb5a0c\",\"name\":\"Tabby Worthington\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/devel.www.cpanel.net\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4391b167db175ebbd14ebfc95ba54f1f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4391b167db175ebbd14ebfc95ba54f1f?s=96&d=mm&r=g\",\"caption\":\"Tabby Worthington\"},\"sameAs\":[\"https:\/\/cpanel.net\/blog\/\"],\"url\":\"https:\/\/devel.www.cpanel.net\/blog\/author\/cptabby\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Apache Log4j exploit and how to protect your cPanel server | cPanel","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/","og_locale":"en_US","og_type":"article","og_title":"The Apache Log4j exploit and how to protect your cPanel server | cPanel","og_description":"On Friday, December 10, 2021, a vulnerability for Log4j was announced in&nbsp;CVE-2021-44228.&nbsp;&nbsp; Log4j&nbsp;is developed by the Apache Foundation and is widely used by both enterprise apps and cloud services.&nbsp;It&nbsp;was&nbsp;reported by Alibaba Cloud&#8217;s security team&nbsp;to Apache on November 24.&nbsp;They also revealed that CVE-2021-44228 impacts default configurations of multiple Apache frameworks, including Apache Struts2, Apache&nbsp;Solr, Apache Druid, [&hellip;]","og_url":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/","og_site_name":"cPanel","article_publisher":"https:\/\/www.facebook.com\/cpanel\/","article_published_time":"2021-12-15T01:45:08+00:00","og_image":[{"width":1200,"height":475,"url":"https:\/\/devel.www.cpanel.net\/wp-content\/uploads\/2021\/12\/The-Apache-Log4J-Exploit-blog-header.png","type":"image\/png"}],"author":"Tabby Worthington","twitter_card":"summary_large_image","twitter_creator":"@cPanel","twitter_site":"@cPanel","twitter_misc":{"Written by":"Tabby Worthington","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/","url":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/","name":"The Apache Log4j exploit and how to protect your cPanel server | cPanel","isPartOf":{"@id":"https:\/\/devel.www.cpanel.net\/#website"},"datePublished":"2021-12-15T01:45:08+00:00","dateModified":"2021-12-15T01:45:08+00:00","author":{"@id":"https:\/\/devel.www.cpanel.net\/#\/schema\/person\/937065f5d955e1a72a1abd851bbb5a0c"},"breadcrumb":{"@id":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/devel.www.cpanel.net\/blog\/products\/the-apache-log4j-exploit-and-how-to-protect-your-cpanel-server\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devel.www.cpanel.net\/"},{"@type":"ListItem","position":2,"name":"The Apache Log4j exploit and how to protect your cPanel server"}]},{"@type":"WebSite","@id":"https:\/\/devel.www.cpanel.net\/#website","url":"https:\/\/devel.www.cpanel.net\/","name":"cPanel","description":"Hosting Platform of Choices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devel.www.cpanel.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/devel.www.cpanel.net\/#\/schema\/person\/937065f5d955e1a72a1abd851bbb5a0c","name":"Tabby Worthington","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/devel.www.cpanel.net\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4391b167db175ebbd14ebfc95ba54f1f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4391b167db175ebbd14ebfc95ba54f1f?s=96&d=mm&r=g","caption":"Tabby Worthington"},"sameAs":["https:\/\/cpanel.net\/blog\/"],"url":"https:\/\/devel.www.cpanel.net\/blog\/author\/cptabby\/"}]}},"_links":{"self":[{"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/posts\/62193"}],"collection":[{"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/users\/85"}],"replies":[{"embeddable":true,"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/comments?post=62193"}],"version-history":[{"count":0,"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/posts\/62193\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/media\/65857"}],"wp:attachment":[{"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/media?parent=62193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/categories?post=62193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devel.www.cpanel.net\/wp-json\/wp\/v2\/tags?post=62193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}