TPS-5057 (cumulative patch) - 8.0

Version
8.0
Language
English (United States)
Product
Talend Big Data
Talend Big Data Platform
Talend Data Fabric
Talend Data Integration
Talend Data Management Platform
Talend Data Services Platform
Talend ESB
Talend MDM Platform
Talend Real-Time Big Data Platform
Module
Talend Identity and Access Management

TPS-5057 (cumulative patch)

Info Value
Patch Name Patch_20211216_TPS-5057_v1
Release Date 2021-12-16
Target Verson 20211216_1-V8.0.1
Product affected LogServer

Introduction

This patch is cumulative. It includes all previous generally available patches for Talend LogServer 8.0.1.

NOTE: For information on how to obtain this patch, reach out to your Support contact at Talend.

Fixed issues

This patch contains the following fixes:

  • TPS-5057: [8.0.1] Patch log4j CVE in LogServer

Prerequisites

Consider the following requirements for your system:

  • Talend LogServer 8.0.1 must be installed.

Installation

  1. Stop LogServer
  2. Create a backup directory
    $ mkdir -p <backup_dir>
    
  3. Copy original elasticsearch-* and logstash-* folders to the backup directory
    $ cp -a <TALEND>/logserv/elasticsearch-* <backup_dir>
    $ cp -a <TALEND>/logserv/logstash-* <backup_dir>
    
  4. Remove vulnerable dependencies
    $ rm -rf <TALEND>/logserv/elasticsearch-*/lib/log4j*.jar
    $ rm -rf <TALEND>/logserv/logstash-*/logstash-core/lib/jars/log4j*.jar
    
  5. Uzip the patch file in the root of LogServer
    $ cd <TALEND>/logserv
    $ unzip Patch_20211216_TPS-5057_v1.zip
    
    Note: if asked to override files please select yes/all
  6. Start LogServer

Uninstallation

  1. Stop LogServer
  2. Remove patched directories and files
    $ rm -rf <TALEND>/logserv/elasticsearch-*/lib
    $ rm -rf <TALEND>/logserv/logstash-*/logstash-core/lib/jars
    
  3. Copy saved folders from the backup directory
    $ cp -rf <backup_dir>/elasticsearch-*/lib <TALEND>/logserv/elasticsearch-*/lib
    $ cp -rf <backup_dir>/logserv/logstash-*/logstash-core/lib/jars <TALEND>/logserv/logstash-*/logstash-core/lib/jars
    
  4. Start LogServer

Affected files for this patch

The following files are installed by this patch: - log4j-api.jar - log4j-core.jar - log4j-slf4j-impl.jar