Vulnerability

BD lists Kiestra and HealthSight products as affected by Apache Log4j flaws

MedDevice Cyber Staff · Feb 4 · 3 min read · Via BD bulletin: Apache Log4j Vulnerability: BD Third-Party Components Impacted

BD published a bulletin on February 4, 2022 on Apache Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046 in third-party components used by certain BD software-enabled products. BD lists the Kiestra TLA, WCA and ReadA with SCU, HealthSight Infection Advisor, HealthSight Clinical Advisor and BD Insights Research Analytics Dashboards.

BD has not received reports of exploitation on BD products. Log4j is a Java logging library, and the flaws let crafted text written to a log trigger remote code loading.

Log4j sat several layers deep in vendor stacks, which is why it took months to find. A product whose SBOM already lists its Java dependencies answers that question in an afternoon.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD's February 4, 2022 bulletin identifies the affected Kiestra, HealthSight and Insights products. Customers should apply BD's remediation for each product as it is released and keep affected servers off the internet. Manufacturers should keep Java dependencies in the SBOM so library CVEs map to products the same day.

Apply BD's product updates. Follow the BD bulletin for each listed Kiestra, HealthSight and Insights product and install the remediated builds.
Restrict outbound traffic. Block unneeded outbound connections from affected servers so a Log4j lookup cannot fetch remote code.
Map Java dependencies. List Log4j and other Java libraries with versions in each product SBOM.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

BD Kiestra TLA, WCA and ReadA with SCU

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by Log4j?

BD's February 4, 2022 bulletin lists BD Kiestra TLA, WCA and ReadA with SCU, BD HealthSight Infection Advisor, BD HealthSight Clinical Advisor and BD Insights Research Analytics Dashboards as affected by Log4j CVE-2021-44228 and CVE-2021-45046 through third-party components.

Has Log4j been exploited on BD products?

BD said in its February 4, 2022 bulletin that it had not received reports of Log4j CVE-2021-44228 or CVE-2021-45046 exploitation on BD products.

← Back to Vulnerabilities