Update Foglight database cartridges from Log4j 1.2.17 to 2.17.1 (4309967)

The following database cartridges use the Log4j 1.2.17 version

• SQL Server (5.9.7.20 through 5.9.7.22)
• Oracle (5.9.7.20 through 5.9.7.22)
• Azure SQL (5.9.7.20 through 5.9.7.22)
• SAP ASE [Sybase] (5.9.7.20 through 5.9.7.22)
• DB2 (5.9.7.20 through 5.9.7.22)

Apache log4j 1.2 vulnerabilities

https://nvd.nist.gov/vuln/detail/CVE-2019-17571

https://nvd.nist.gov/vuln/detail/CVE-2021-4104

https://nvd.nist.gov/vuln/detail/CVE-2022-23307

https://nvd.nist.gov/vuln/detail/CVE-2022-23305

https://nvd.nist.gov/vuln/detail/CVE-2022-23302

WORKAROUND

None

STATUS

An updated version of the following databases cartridges at the 5.9.7.23 version level which includes the log 4j version 2.17.1.

The following updated cartridges can be downloaded from Supportlink here: https://support.quest.com/foglight-for-databases/5.9.7/download-new-releases

Database cartridges from the following list at or below the 5.9.7.22 release should be upgraded to 5.9.7.23

• SQL Server 
• Oracle 
• Azure SQL 
• DB2
• SAP ASE [Sybase]