oracle 客户端 11.2 和 oracle 客户端 12 是否存在 log4j 安全问题？答案

【问题标题】：Are Oracle client 11.2 and Oracle client 12 vulnerable with the Log4j security issue?oracle 客户端 11.2 和 oracle 客户端 12 是否存在 log4j 安全问题？
【发布时间】：2022-01-16 23:56:46
【问题描述】：

我正在阅读有关 log4j 的安全问题，并且我了解该产品受到该漏洞的影响。但是我想知道 oracle 客户端 11.2 和 12 是否受此问题的影响。我找不到这些产品是否使用任何 log4j 依赖项或任何说明这些产品是否受到影响的文档。

如果其他 oracle 产品受到此问题的影响，有人可以向我澄清一下吗？我在哪里可以检查这些客户端使用哪些依赖项？

【问题讨论】：

标签： oracle log4j oracleclient

【解决方案1】：

下面的链接会让您知道哪些 Oracle 产品需要为 log4j 打补丁。

编辑：我添加了文档的一部分，其中显示了 log4j2 补丁不需要的 Oracle 产品列表。

5.0 Oracle products not requiring patches  

At this point in time, Oracle doesn’t believe the following products to be affected by vulnerability CVE-2021-44228:  

Application Testing Suite [Product ID 4622]  
Argus Analytics [Product ID 9171]  
Argus Mart [Product ID 10383]  
Banking Digital Experience [Product ID 12605]  
Berkeley DB [Product ID 2051]  
Commerce Platform [Product ID 9348]  
Commerce Service Center [Product ID 9351]  
Communications Converged Application Server [Product ID 5382]  
Communications EAGLE FTP Table Base Retrieval [Product ID 11116]  
Communications Network Integrity [Product ID 4491]  
Communications Order and Service Management [Product ID 2270]  
CRF Submit Requestor [Product ID 9641]  
Database Gateway for APPC [Product ID 774]  
Demantra Demand Management [Product ID 2100]  
Enterprise Data Quality [Product ID 9464]  
Enterprise Manager for MySQL Database [Product ID 11166]  
Exalytics Software [Product ID 9736]  
FLEXCUBE Direct Banking [Product ID 9111]  
Health Insurance Claims Management Data Marts [Product ID 9313]  
Health Insurance Data Management [Product ID 10643]  
Healthcare Data Repository [Product ID 9161]  
JD Edwards EnterpriseOne Deployment Server [Product ID 4781]  
JD Edwards EnterpriseOne Enterprise Server [Product ID 4781]  
JD Edwards EnterpriseOne Enterprise Server Platform Pack [Product ID 4781]  
JD Edwards EnterpriseOne Server Manager [Product ID 4781]  
JD Edwards World [Product ID 4839]  
Mobile Application Framework [Product ID 11055]  
MySQL Server [Product ID 8478]  
Oracle Access Manager / Webgates [Product ID 5565]  
Oracle Access Manager [Product ID 5565]  
Oracle Application Express [Product ID 1348]  
Oracle Audit Vault and Database Firewall [Product ID 9749]  
Oracle Big Data Spatial and Graph [Product ID 11528]  
Oracle Blockchain Cloud Service [Product ID 13444]  
Oracle Business Intelligence Enterprise Edition [Product ID 2025]  
Oracle Business Intelligence Publisher [Product ID 1479]  
Oracle Client [Product ID 5]  
Oracle Coherence [Product ID 2545]  
Oracle Commerce Guided Search/Oracle Commerce Experience Mgr [Product ID 9633]  
Oracle Communications Calendar Server [Product ID 8494]  
Oracle Communications Contacts Server [Product ID 10696]  
Oracle Communications Control Plane Monitor [Product ID 10764]  
Oracle Communications EAGLE [Product ID 10768]  
Oracle Communications EAGLE Application Processor [Product ID 11122]  
Oracle Communications EAGLE Element Management System [Product ID 11125]  
Oracle Communications EAGLE LNP Application Processor [Product ID 11118]  
Oracle Communications Fraud Monitor [Product ID 10763]  
Oracle Communications LSMS [Product ID 11114]  
Oracle Communications MetaSolv Solution [Product ID 2267]  
Oracle Communications Operations Monitor [Product ID 10761]  
Oracle Communications Session Border Controller [Product ID 10750]  
Oracle Communications User Data Repository [Product ID 11108]  
Oracle Database (not exploitable) [Product ID 5] [See MOS Note 2796575.1]  
Oracle Database Appliance [Product ID 9435]  
Oracle Database Global Service Manager [Product ID 5]  
Oracle Directory Server Enterprise Edition [Product ID 8512]  
Oracle Documaker [Product ID 5477]  
Oracle Enterprise Operations Monitor [Product ID 10762]  
Oracle Enterprise Session Border Controller [Product ID 10757]  
Oracle Enterprise Telephony Fraud Monitor [Product ID 13804]  
Oracle Exadata Storage Server Software [Product ID 2546]  
Oracle Fail Safe [Product ID 843]  
Oracle Forms [Product ID 45]  
Oracle Global Lifecycle Management Repository Creation Utility [Product ID 12746]  
Oracle GoldenGate [Product ID 5757]  
Oracle GoldenGate for HP Nonstop [Product ID 13046]  
Oracle Health Insurance Claims Management [Product ID 9307]  
Oracle Health Insurance Claims Management Web Services [Product ID 9311]  
Oracle Health Insurance Disbursements and Collections [Product ID 9308]  
Oracle Health Insurance Long Term Care [Product ID 9394]  
Oracle Health Insurance Policy Administration [Product ID 9306]  
Oracle Health Insurance Policy Administration Data Marts [Product ID 9312]  
Oracle Health Insurance Policy Administration Web Services [Product ID 9310]  
Oracle Health Sciences Argus Safety [Product ID 5710]  
Oracle Health Sciences Clinical Development Analytics [Product ID 5563]  
Oracle Health Sciences InForm [Product ID 9636]  
Oracle Hospitality RES 3700 [Product ID 11596]  
Oracle Hospitality Simphony [Product ID 11594]  
Oracle Hospitality Simphony First Edition [Product ID 11591]  
Oracle HTTP Server [Product ID 1042]  
Oracle Internet Directory [Product ID 355]  
Oracle Key Vault [Product ID 10221]  
Oracle MapViewer [Product ID 1215]  
Oracle MiniCluster S7-2 Engineered System [Product ID 12598]  
Oracle NoSQL Database [Product ID 13373]  
Oracle Retail Advanced Inventory Planning [Product ID 1785]  
Oracle Retail Data Model [Product ID 2538]  
Oracle SD-WAN Aware [Product ID 13941]  
Oracle SD-WAN Edge [Product ID 13940]  
Oracle Secure Backup [Product ID 1522]  
Oracle Service Architecture Leveraging Tuxedo (SALT) [Product ID 5435]  
Oracle SOA Suite [Product ID 1162]  
Oracle StorageTek Tape Analytics [Product ID 10085]  
Oracle TimesTen In-Memory Database [Product ID 1870]  
Oracle Tuxedo Application Rehosting Workbench [Product ID 8485]  
Oracle Tuxedo Mainframe Adapter for OSI TP [Product ID 5439]  
Oracle VM [Product ID 4455]  
Oracle VM VirtualBox [Product ID 8370]  
Oracle Warehouse Builder [Product ID 9]  
Oracle WebCenter Content [Product ID 2271]  
Oracle WebCenter Content: Imaging [Product ID 4576]  
Oracle WebCenter Enterprise Capture [Product ID 10212]  
Oracle WebLogic Server (not exploitable) [Product ID 5242] [See MOS Note 2827793.1]  
Oracle ZFS Storage Appliance Kit [Product ID 10026]  
PeopleSoft Enterprise CRM Client Management [Product ID 4860]  
PeopleSoft Enterprise CS Install [Product ID 9068]  
PeopleSoft Enterprise FIN Install [Product ID 8925]  
PeopleSoft Enterprise FIN Supply Chain Portal Pack Brazil [Product ID 8883]  
PeopleSoft Enterprise HCM Human Resources [Product ID 5071]  
PeopleSoft Enterprise PRTL Interaction Hub [Product ID 5090]  
Policy Automation for Mobile Devices [Product ID 5626]  
Portable ClusterWare [Product ID 5]  
Private Cloud Appliance [Product ID 10635]  
Rapid Planning [Product ID 5235]  
Secure Global Desktop [Product ID 8539]  
Siebel Core - Services Security [Product ID 9001]  
Sun StorageTek Tape Library ACSLS [Product ID 10088]  
Tekelec Platform [Product ID 11269]  
Transportation Management [Product ID 1991]  
Universal Installer [Product ID 662]  
Zero Data Loss Recovery Appliance [Product ID 11342]

参考：（需登录）

https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=294496371045198&id=2827611.1&_afrWindowMode=0&_adf.ctrl-state=aof21bja3_4

【讨论】：

只需要登录链接到login.oracle.com/mysso/signon.jsp
您的答案可以通过额外的支持信息得到改进。请edit 添加更多详细信息，例如引用或文档，以便其他人可以确认您的答案是正确的。你可以找到更多关于如何写好答案的信息in the help center。
链接中的信息是否也可以在其他地方使用而无需提供登录数据

【解决方案2】：

Oracle 的注释说不需要修补 Oracle 客户端

5.0 不需要补丁的 Oracle 产品： Oracle 客户端 [产品 ID 5]

但是，我在 Oracle Client 12.2 安装中看到了 log4j 文件。 ..\product\12.2.0\client_1\sqldeveloper\sqldeveloper\lib\log4j-1.2.13.jar

我有点迷茫……

【讨论】：

我们也很困惑他们不是关于这个产品的信息。我在 Oracle 11.2.0 客户端中找到了这些文件：C:\Oracle\product\11.2.0\client_1\oui\jlib\jlib\log4j-core.jar C:\Oracle\product\11.2.0\client_1\sysman\jlib\log4j-core.jar 如果受到影响，仍然没有任何线索

【解决方案3】：

看起来它使用的是log4j 1.2版本，不受log4j当前漏洞的影响。这就是为什么它被列为不需要补丁的原因。

【讨论】：