Do we have impact of "CVE-2021-44228 — Apache Log4j Vulnerability" on Microsoft SQL Server Express 2019?

P, Manjunatha 1

Hi All,

I am using Microsoft Sql Server 2019 express edition which has a reference to log4j-1.2.17.jar in my .Net web app.

will this be having any impact? Does Microsoft release any security patch updates or sql server updates to mitigate this vulnerability ?

1 answer

Leon Laude 85,666 Reputation points

2021-12-14T14:44:30.447+00:00
Hi @P, Manjunatha ,

The versions affected are from 2.0-beta9 to 2.14.1, lower versions such as the one you've posted in the screenshot are not vulnerable to the Log4J "Log4Shell" Zero-Day Vulnerability but is still recommended to be updated to the latest version.

SQL Server in itself is not vulnerable, unless you have extensions that make use of the Log4j.

For more information see:

https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228

----------

If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!

Best regards,
Leon
Please sign in to rate this answer.
Vadims Podāns 9,111 Reputation points MVP

2021-12-14T15:01:08.43+00:00

I would add that no Microsoft products ship Log4J. Only custom applications (mostly, Java-based) may ship them. As the result, Microsoft won't provide patches because they don't own Log4J nor use it in their applications.

P, Manjunatha 1 Reputation point

2021-12-14T16:23:34.347+00:00

Please install Microsoft SQL Server 2019 and follow the screenshot path, it will list the set of jar in the installation folder.

Vadims Podāns 9,111 Reputation points MVP

2021-12-14T19:42:24.37+00:00

These are JDBC drivers only. Microsoft does not ship Java runtime, thus these jar files cannot be activated.

P, Manjunatha 1 Reputation point

2021-12-15T04:52:11.92+00:00

Thank you.

B Rent 1 Reputation point

2022-01-28T00:50:16.517+00:00

Tenable (if anyone else uses Nessus as their vulnerability scanner) has recently decided fresh off the log4j zero day that all versions of log4j, including 1.2.17 as shown in the user's screenshot here, are now CRITICAL level vulnerabilities. https://www.tenable.com/plugins/nessus/156032

-Brent

Lauren Glenn 1 Reputation point

2022-10-01T15:17:59.647+00:00

So essentially, to evade or resolve a Tenable / vulnerability scan for Log4j if we're not using Java on that server is that we can just remove the JAR file from the machine with no ill effects since Microsoft is not using it? Seems like a simple solution to a complex problem.
Sign in to comment