Alert: DocuSign update on Log4j2 vulnerability
01/31/2022
DocuSign has been actively working on assessing risk and treating affected assets since the Log4j vulnerabilities were initially disclosed on the morning of December 9.
As of January 31, DocuSign continues to observe no indicators of compromise in our environment from Log4j. DocuSign has previously deployed and continues to enhance countermeasures consistent with published CISA guidance to provide layers of protection and increased situational awareness through regular monitoring and blocking of suspicious activity.
DocuSign has completed a 3rd party supply chain risk assessment with its critical suppliers to confirm that they have mitigations in place and are updating their software or services to remediate this issue. As new information surfaces, we will require suppliers to implement additional remediation actions as appropriate.
As of January 31, DocuSign can confirm that the following services have been addressed and are not vulnerable to the initial Log4j2 vulnerabilities (CVE-2021-44228 and CVE-2021-45046). Two additional vulnerabilities (CVE-2021-45105 and CVE-2021-44832), both medium severity, are being addressed through normal patching cycles.
Product status can change as more information becomes available.
PRODUCT | STATUS |
eSignature | Product is affected by CVE-2021-44228, CVE-2021-45046 scoped to a beta pre-release feature for a single customer who had been previously informed. All configurations have been treated and are not vulnerable. |
CLM | Product is affected by CVE-2021-44228, CVE-2021-45046. All configurations have been treated and are not vulnerable. |
Insight | Product is affected by CVE-2021-44228, CVE-2021-45046. All configurations have been treated and are not vulnerable. |
Legacy LiveOak | Product is not affected by CVE-2021-44228, CVE-2021-45046. |
Rooms | Product is affected by CVE-2021-44228, CVE-2021-45046. All configurations have been treated and are not vulnerable. |
Notary | Product is affected by CVE-2021-44228, CVE-2021-45046 scoped to a beta pre-release feature for a single customer who had been previously informed. All configurations have been treated and are not vulnerable. |
DocuSign would like to re-emphasize the severity of the Log4j vulnerabilities, whereby the remote code execution zero days (CVE-2021-44228 and CVE-2021-45046) allow malicious actors to craft a payload that can trigger the execution of arbitrary code on application servers. DocuSign is responding accordingly and DocuSign teams have active plans to remediate CVE-2021-4104, CVE-2021-45105 and CVE-2021-44832 in alignment with established internal processes. We will continue to monitor threat intelligence for further prioritization as information becomes available. The Log4j library is used extensively in Java-based solutions industry-wide and is not limited to DocuSign services.
Please note, information shared in Trust alerts are intended for a general audience only. Additional information may be provided to customers regarding their affected DocuSign Service configurations beyond Trust alerts, including through Support notices.
We encourage you to perform an assessment of your specific endpoint implementations for use of the Log4j service, including third-party services. This CISA article provides more detail into the issue. Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.