Impact of CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832 Apache Log4j Vulnerabilities for Veritas Products

Description

Veritas is aware of the recently announced zero-day vulnerability in Apache’s Log4j component (CVE-2021-44228), as well as the related vulnerabilities described in CVE-2021-45046, CVE-2021-45105, CVE-2021-44832.  All Veritas Product Security and Development teams are actively reviewing our software to determine if these vulnerabilities exist in any of our products. 

If we determine a particular product is impacted by these issues, Veritas will provide temporary mitigation guidance while we work to quickly provide a patch to permanently address the problem.  This is an urgent issue, and we are working aggressively to help keep our customers secure.  We will provide updates and guidance as soon as possible.

Please see below for links to specific Veritas products. This page will be updated frequently as we learn more.

Appliance - Access 3340 and Access BYOS:
https://www.veritas.com/content/support/en_US/article.100052105

Appliance Management Server (AMS):
Not impacted by this vulnerability

Appliance - NetBackup:
https://www.veritas.com/content/support/en_US/article.100052082

Appliance - NetBackup Flex:
https://www.veritas.com/content/support/en_US/article.100052106 

Appliance - NetBackup Flex Scale:
https://www.veritas.com/content/support/en_US/article.100052101

APTARE IT Analytics:
https://www.veritas.com/content/support/en_US/article.100052081

Backup Exec:
Not impacted by this vulnerability

eDiscovery Platform:
https://www.veritas.com/support/en_US/article.100052068

Enterprise Vault:
https://www.veritas.com/support/en_US/article.100052066

EV.cloud, Merge1, VIC, VAS:
https://www.veritas.com/content/support/en_US/article.100052069

InfoScale:
https://www.veritas.com/content/support/en_US/article.100052064

NetBackup:
https://www.veritas.com/content/support/en_US/article.100052058

NetBackup Media Server Deduplication Engine:
https://www.veritas.com/content/support/en_US/article.100052062

NetBackup OpsCenter:
https://www.veritas.com/content/support/en_US/article.100052058

NetBackup SaaS Protection (NSP):
https://www.veritas.com/content/support/en_US/article.100052125

Veritas Desktop and Laptop Option (DLO):
https://www.veritas.com/content/support/en_US/article.100052093

Veritas NetInsights:
Not impacted by this vulnerability

Veritas System Recovery:
Not impacted by this vulnerability

Disclaimer
THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.