Vulnerability

Karl Storz says older StreamConnect and SCENARA versions carry Log4j 1.x exposure to CVE-2021-4104

MedDevice Cyber Staff · Dec 17 · 3 min read · Via KARL STORZ security notice Apache Log4j

KARL STORZ published a security notice on December 17, 2021 on the Apache Log4j logging tool flaws CVE-2021-44228 and CVE-2021-4104, revised to Rev 1.2 on January 14, 2022. Currently supported KARL STORZ products do not use Log4j 2.x and are unaffected by CVE-2021-44228.

Older versions are where the exposure sits. WUIS3529 StreamConnect v4.1.3 or lower, WS11140 SCENARA.media version 3.0 and WS111 SCENARA.core (all versions) use Log4j 1.x and may be affected by CVE-2021-4104, which is not exploitable in the default configuration.

KARL STORZ recommends removing the older versions from the network or upgrading. A default-safe configuration holds only until someone changes it, so upgrade instead of auditing configs.

Are you a representative of Karl Storz? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Older StreamConnect, SCENARA.media and SCENARA.core installs use Log4j 1.x and may be exposed to CVE-2021-4104, though not in the default configuration. KARL STORZ recommends upgrading or removing them from the network.

Find old versions. Locate any StreamConnect v4.1.3 or lower, SCENARA.media 3.0 and SCENARA.core installs.
Upgrade or disconnect. Upgrade them to supported versions or remove them from the network, as KARL STORZ recommends.
Hold the default configuration. Until the upgrade, keep Log4j 1.x at its default configuration, where CVE-2021-4104 is not exploitable.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

Contributing

Hospital network

StreamConnect

Off-the-shelf software

SCENARA.media

Off-the-shelf software

SCENARA.core

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Are Karl Storz products affected by Log4j CVE-2021-44228?

No for currently supported products. KARL STORZ's December 17, 2021 notice says they do not use Log4j 2.x and are unaffected by CVE-2021-44228.

Which Karl Storz products may be affected by CVE-2021-4104?

WUIS3529 StreamConnect v4.1.3 or lower, WS11140 SCENARA.media version 3.0 and WS111 SCENARA.core (all versions) use Log4j 1.x and may be affected by CVE-2021-4104, per KARL STORZ's notice revised January 14, 2022.

← Back to Vulnerabilities