A security patch for NorthStar Controller versions 5.1, 6.0, 6.1, and 6.2 are available from the Software Downloads page. 

This article explains how to prepare for and install the security patch, which is the resolution for JSA11259 [juniper.net] .

If you have previously manually installed log4j 2.15 or 2.16 onto your NorthStar Controller, you will need to delete those files before you install the security patch because the security patch will look for log4j 2.9 and remove it before installing log4j 2.17.

If you have 2.15 or 2.16 already installed, after the security patch installation, there will be multiple versions of log4j. The end result in this case would be that elasticsearch will not start.

First, if you have manually installed 2.15 or 2.16, remove them from /opt/northstar/thirdparty/elasticsearch/lib and /opt/northstar/thirdparty/logstash/logstash-core/lib/jars .

After confirming that you no longer have log4j in those two directories, install the security patch with the syntax rpm -Uvh <security patch filename> .

For example, if you are installing the security patch on 5.1, the syntax would be:

rpm -Uvh NorthStar_5.x.x-Patch-SECURITY-JSA11256-20211220_172348-fc9d53d_8.x86_64.rpm

The rpm script will delete log4j 2.9, and then install log4j 2.17. It will then restart the NorthStar processes elasticsearch and logstash.

However, if you did not delete log4j versions 2.15 or 2.16, and you ran the security patch, elasticsearch will not start. You will see the following message when viewing supervisorctl status:

[root@localhost northstar]# supervisorctl status
analytics:elasticsearch          FATAL     Exited too quickly (process log may have details)

Additionally, in the elasticsearch.msg file, you will see the following:

Sending TERM signal to elasticsearch
Waiting for elasticearch to exit, retry count  1
Elasticsearch exit status  143
[2022-03-03T15:45:37,024][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: jar hell!

To recover from this, delete the log4j 2.15 and/or 2.16 versions, and then restart elasticsearch ( supervisorctl restart analytics:elasticsearch ). You will see an error stating that it is not running, but after a couple of minutes, it will recover, and the process will start.

[root@localhost lib]# supervisorctl restart analytics:elasticsearch
analytics:elasticsearch: ERROR (not running)
analytics:elasticsearch: started
[root@localhost lib]#