Tell HN: The software run by nearly every CA is affected by Log4J

#1

Post by DyslexicAtheist » Sat, Dec 11, 2021, 12:29 AM UTC

PrmeKey's EJBCA[1] is the de-facto standard of PKI software sold to certificate authorities (CA). EJBCA is a Jboss based J2EE application that heavily uses log4j. And it heavily uses log4j and also seems vulnerable to log4shell.

This will end badly because despite the big talk of most CA's hardly anyone has an HSM. Secrets usually are in a database in several places I worked at. And those that do have an HSM it's just a Gemalto "soft HSM" running as a "VM appliance".

[1] https://www.ejbca.org/

Re: Tell HN: The software run by nearly every CA is affected by Log4J

#2

Post by hablutzel1 » Sat, Dec 11, 2021, 1:27 AM UTC

If I'm not wrong this vulnerability affects Log4j 2.x onwards and the latest EJBCA from https://github.com/primekeydevs/ejbca-ce appears to be using only Log4j 1.2.17.

Re: Tell HN: The software run by nearly every CA is affected by Log4J

#3

Post by karansachdeva24 » Mon, Dec 13, 2021, 12:19 PM UTC

hablutzel1 wrote: post #2

If I'm not wrong this vulnerability affects Log4j 2.x onwards and the latest EJBCA from https://github.com/primekeydevs/ejbca-ce appears to be using only Log4j 1.2.17.

How did you confirm the log4j version?

Re: Tell HN: The software run by nearly every CA is affected by Log4J

#4

Post by brohee » Mon, Dec 13, 2021, 4:56 PM UTC

The CAB forum BR requires that CAs use HSMs, so I call bullshit. Those soft HSMs are used in dev environments. Unless you talk about enterprises internal CA, where the storage of keys is usually not the biggest concern.

https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

6.2.7 Private key storage on cryptographic module The CA SHALL protect its Private Key in a system or device that has been validated as meeting at least FIPS 140 level 3 or an appropriate Common Criteria Protection Profile or Security Target, EAL 4 (or higher), which includes requirements to protect the Private Key and other assets against known threats

Re: Tell HN: The software run by nearly every CA is affected by Log4J

#5

Post by maurom » Tue, Dec 14, 2021, 3:55 PM UTC

hablutzel1 wrote: post #2

If I'm not wrong this vulnerability affects Log4j 2.x onwards and the latest EJBCA from https://github.com/primekeydevs/ejbca-ce appears to be using only Log4j 1.2.17.

Indeed, there's no sight of log4j2 on EJBCA Community deployments

Re: Tell HN: The software run by nearly every CA is affected by Log4J

#6

Post by hablutzel1 » Wed, Dec 15, 2021, 9:24 PM UTC

karansachdeva24 wrote: post #3

hablutzel1 wrote: post #2

If I'm not wrong this vulnerability affects Log4j 2.x onwards and the latest EJBCA from https://github.com/primekeydevs/ejbca-ce appears to be using only Log4j 1.2.17.

How did you confirm the log4j version?

Look at the the Log4j version under https://github.com/primekeydevs/ejbca-ce/tree/main/lib.