This is urgent security advisory about a vulnerability in the library Log4j, which Metabase uses. You should upgrade immediately! If you are a Metabase Cloud customer, you don't need to do anything as your instance has already been patched. Affected versions: any x.37.x, below x.38.6, below x.39.…

Hi guys, thank you for the update! According to Apache further vulnerabilities have been identified which have been fixed in 2.16.0 From what I can tell the updates underlying your post here are in reference to you updating to 2.15.0 which closed an initial set of vulnerabilities. More info here…

@SetSails Read this: https://github.com/metabase/metabase/issues/19371 Yes, that's how you add multiple Java parameters.

Thx for the update @flamber ! As @SetSails mentioned there is a 2nd vulnerability (CVE-2021-45046) that Apache suggest would be best resolved with an update to 2.16.0. Additionally, on their advisory page, Apache also reports previously advised mitigations are no longer considered suitable: Othe…

Hi Herve, as you can read in the Apache advisory page, the CVE-2021-45046 has a CVSS Score of 3.7 (Log4Shell has a CVSS score of 10) as it can only cause a DoS only if you use non-standard Log4j configuration. The Metabase server ships bundled with a standard logging configuration so we're not impac…

Hi @dragonsahead , It appears Log4j 2.15.0 is still vulnerable to data exfiltration. Please consider expediting the release which contains the merged upgrade to 2.16.0! Thank you :pray:

Hi @charty , although that CVE has not been recognized yet by the team in Log4j, we have just released 41.5 with Log4j 2.16.

Hi folks, Seems that log4j 2.16 has still a security flaw :crazy_face: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105 Is Metabase concerned and need a new upgrade ? Nicolas

@nico8 Try upgrading the latest release: https://github.com/metabase/metabase/releases/latest Log4j 2.16.0 and 2.17.0 does not affect Metabase from all the testing we've done, which is why they are just released as dependency upgrades and without any advisory.

Hi, is there any concern for CVE-2021-44832? Would also like to know when CVE-2021-45105 will be patched in the next release. Thank you.

@ewing0 No, CVE-2021-44832 and CVE-2021-45105 does not affect Metabase. The Log4j dependency will be upgraded in next release coming in January.

Metabase Discussion

Urgent Security Upgrade for Metabase

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled