TIBCO is aware of the recently announced Apache Log4J vulnerability (CVE-2021-44228), referred to as “Log4Shell”. Performing these attacks requires an attacker to have control of log messages or at least the parameters for a given log message. This vulnerability theoretically enables arbitrary code to be executed on the affected system.

TIBCO’s Security Team is actively monitoring the information coming out about the Apache Log4J Vulnerability and our Product Security Incident Response Team (PSIRT) is actively evaluating how this vulnerability may affect TIBCO products and cloud services.

Update – 2/3/22
TIBCO has released the following hotfixes for TIBCO Foresight Translator. These hotfixes include version 2.17.1 of Apache Log4j, which mitigates the latest security vulnerabilities reported by Apache (CVE-2021-45046 and CVE-2021-44832). 

TIBCO Foresight Translator (Healthcare and Standard Editions) – 3.8.0 HF3
TIBCO Foresight Translator (Healthcare and Standard Editions) for z/Linux – 3.8.0 HF3
TIBCO Foresight Translator (Healthcare and Standard Editions) – 3.8.0 HF3
TIBCO Foresight Translator (Healthcare and Standard Editions) for z/Linux – 3.8.0 HF3

A separate notification was sent for each hotfix with instructions for applying the fix.

Update – 1/20/22
TIBCO has released the following hotfixes for TIBCO Foresight Translator. These hotfixes include version 2.17.1 of Apache Log4j, which mitigates the latest security vulnerabilities reported by Apache (CVE-2021-45046 and CVE-2021-44832). 

TIBCO Foresight Translator (Healthcare and Standard Editions) – 4.0.0 HF7
TIBCO Foresight Translator (Healthcare and Standard Editions) for z/Linux – 4.0.0 HF7
TIBCO Foresight Translator (Healthcare and Standard Editions) – 4.1.0 HF2
TIBCO Foresight Translator (Healthcare and Standard Editions) for z/Linux – 4.1.0 HF2

A separate notification was sent for each hotfix with instructions for applying the fix.

TIBCO is currently working on the hotfix for TIBCO Foresight Translator (Healthcare and Standard Editions) – 3.8.0.

Update – 1/14/22
TIBCO is planning to provide an additional hotfix for Translator that will include Log4j version 2.17.1. The new targeted release date is 1/18/21.

Update – 1/6/22
TIBCO is planning to provide an additional hotfix for Translator that will include Log4j version 2.17.1. We plan to release this hotfix early next week.

Update – 1/4/22
TIBCO has released the following hotfixes for TIBCO Foresight Translator. These hotfixes include version 2.16.0 of Apache Log4j, which mitigates the Log4j vulnerability in Translator.

TIBCO Foresight Translator (Healthcare and Standard Editions) – 4.0.0 HF6
TIBCO Foresight Translator (Healthcare and Standard Editions) for z/Linux – 4.0.0 HF6
TIBCO Foresight Translator (Healthcare and Standard Editions) – 4.1.0 HF1
TIBCO Foresight Translator (Healthcare and Standard Editions) for z/Linux – 4.1.0 HF1

A separate notification was sent for each hotfix with instructions for applying the fix.

TIBCO is currently working on the hotfix for TIBCO Foresight Translator (Healthcare and Standard Editions) – 3.8.0.

Update – 1/3/22
The hotfix that addresses the Log4j security vulnerability will be available soon. Our target release date is 1/4/22.  As mentioned previously, the hotfix will include version 2.16.0 of Apache Log4j.

Also, we have received several inquiries regarding Log4j version 2.16.0 and the latest security vulnerability reported by Apache (CVE-2021-45105). In this notification, Apache states “Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.”

The logging configuration included in TIBCO Foresight Translator (Healthcare and Standard Editions) versions 4.0.0 and 4.1.0 does not utilize a non-default Pattern Layout with a Context Lookup. Therefore, TIBCO Foresight Translator is not vulnerable to this type of attack.

However, we are reviewing the requests to upgrade Log4j to version 2.17. We will provide more information about our plans to include Log4j version 2.17 in a subsequent notification.

Update – 12/20/21
TIBCO is working on the hotfix for TIBCO Foresight Translator (Healthcare and Standard Editions), versions 4.1.0, 4.0.0, 3.8.0. As mentioned previously, the hotfix will include version 2.16.0 of Apache Log4j. We will distribute another notification once it becomes available.