Tell HN: The software run by nearly every CA is affected by Log4J

Posted by DyslexicAtheist on Friday December 10, 2021 @07:29PM
from the self-post dept.

PrmeKey's EJBCA[1] is the de-facto standard of PKI software sold to certificate authorities (CA). EJBCA is a Jboss based J2EE application that heavily uses log4j. And it heavily uses log4j and also seems vulnerable to log4shell.

This will end badly because despite the big talk of most CA's hardly anyone has an HSM. Secrets usually are in a database in several places I worked at. And those that do have an HSM it's just a Gemalto "soft HSM" running as a "VM appliance".

[1] https://www.ejbca.org/

( 5 comments | 6 points | on HN )

Re:Tell HN: The software run by nearly every CA is affected ... by brohee on Monday December 13, 2021 @11:56AM (#29541389)

The CAB forum BR requires that CAs use HSMs, so I call bullshit. Those soft HSMs are used in dev environments. Unless you talk about enterprises internal CA, where the storage of keys is usually not the biggest concern.

https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

6.2.7 Private key storage on cryptographic module The CA SHALL protect its Private Key in a system or device that has been validated as meeting at least FIPS 140 level 3 or an appropriate Common Criteria Protection Profile or Security Target, EAL 4 (or higher), which includes requirements to protect the Private Key and other assets against known threats

[ Parent | on HN ]

Re:Tell HN: The software run by nearly every CA is affected ... by hablutzel1 on Friday December 10, 2021 @08:27PM (#29517523)

If I'm not wrong this vulnerability affects Log4j 2.x onwards and the latest EJBCA from https://github.com/primekeydevs/ejbca-ce appears to be using only Log4j 1.2.17.

[ Parent | on HN ]

Re:Tell HN: The software run by nearly every CA is affected ... by maurom on Tuesday December 14, 2021 @10:55AM (#29552927)

Indeed, there's no sight of log4j2 on EJBCA Community deployments

[ Parent | on HN ]

Re:Tell HN: The software run by nearly every CA is affected ... by karansachdeva24 on Monday December 13, 2021 @07:19AM (#29538911)

How did you confirm the log4j version?

[ Parent | on HN ]

Re:Tell HN: The software run by nearly every CA is affected ... by hablutzel1 on Wednesday December 15, 2021 @04:24PM (#29571817)

Look at the the Log4j version under https://github.com/primekeydevs/ejbca-ce/tree/main/lib.

[ Parent | on HN ]