Security at TIBCO

Security@TIBCO

TIBCO takes its security responsibilities very seriously. This page provides information about TIBCO security and how customers or security researchers can contact TIBCO to report or ask about a security issue.

Report an Issue
Contact Us
Security at TIBCO

Public Notice

Apache Log4J Vulnerability Daily Update

13 December 2021

TIBCO continues to work on investigating and identifying mitigations for the Apache Log4J vulnerability (CVE-2021-44228), referred to as the “Log4Shell” vulnerability. The sections below contain the current status of these efforts. TIBCO continues to make the investigation and remediation of this vulnerability its top priority.

Here is the current status as of the publication time of this update.

TIBCO products whose current standard support versions either do not use Apache Log4J or are not on an affected version of Log4J:

(new information from previous updates is in bold)

  • TIBCO ActiveMatrix® Service Grid Platform
  • TIBCO ActiveSpaces® version 4.x
  • TIBCO Apache Kafka Distribution
  • TIBCO® API Exchange Gateway
  • TIBCO® API Exchange Manager
  • TIBCO® BPM Enterprise 4.3.x product line (formerly known as TIBCO® ActiveMatrix BPM)
    • See Note 1 below
  • TIBCO ActiveMatrix BusinessWorks™ Plug-in for MDM
  • TIBCO BusinessEvents®
  • TIBCO BusinessWorks™ 5.14.0 (TRA 5.11.x) and prior version
    • See Note 1 below
    • TIBCO BusinessWorks™ 5 version 5.15.0 (TRA 5.12.0) is still under investigation.
    • TIBCO is still investigating the BusinessWorks 5 ecosystem that depends on BusinessWorks 5.15.0 (TRA 5.12.0).
  • TIBCO BusinessWorks 6 Runtime version 6.8.0 and previous versions
    • TIBCO is still investigating the remainder of the TIBCO BusinessWorks 6 ecosystem
    • See Note 1 below
  • TIBCO BusinessWorks™ Container Edition Runtime version 2.7.0 and previous versions
    • TIBCO is still investigating the remainder of the TIBCO BusinessWorks 2.7.0 Container Edition ecosystem
    • See Note 1 below
  • TIBCO BusinessWorks™ Mainframe adapters and plugins
  • TIBCO BusinessWorks™ Workflow Additional Process Engine
  • TIBCO Cloud™ API Management - Local Edition
  • TIBCO® Data Science for TIBCO Spotfire® Analyst Version
  • TIBCO DataSynapse™ High-Performance Computing Cloud Adapter
  • TIBCO® Enterprise Administrator
  • TIBCO Enterprise Message Service™
  • TIBCO Enterprise Message Service™ Appliance (EMSA)
  • TIBCO Flogo® Enterprise and all connectors
  • TIBCO FTL® and eFTL
  • TIBCO® Fulfillment Catalog Software versions 3.0.0 thru 4.1.0
  • TIBCO® Fulfillment Provisioning
    • See Note 1 below
  • TIBCO® GeoAnalytics
  • TIBCO® Graph Database
  • TIBCO GridServer®
  • TIBCO Hawk® version 6 and below
  • TIBCO iProcess® version 11.7.0 and below
  • TIBCO iWay® Service Manager
  • TIBCO LABS™ Project Discover
  • TIBCO® Messaging - Eclipse Mosquito Distribution
  • TIBCO® Product and Service Catalog
  • TIBCO Rendezvous® version 8.5.1 and above
  • TIBCO Scribe® Insight
  • TIBCO Scribe® Online
  • TIBCO Statistica®

TIBCO is monitoring and working with it’s third-party vendors on this issue and we will provide additional information as it becomes available on the effect of those vendor’s offerings on TIBCO products. 

Notes:

  1. If a customer has implemented the JMSAppender class for plugins they have written they should check to make sure they don’t expose this vulnerability. For more details see: https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301

 

TIBCO Products with Hotfixes or Services Packs available:

 

TIBCO products that have remediation documentation available: