Companies of all sizes are facing heightened cyber security threats in response to state actors, increasing supply chain attacks and open source vulnerabilities. Keeping customers informed, enabled and protected is Sumo Logic's highest priority.
November 10, 2023 - 4:00PM PST
WHAT SHOULD YOU DO (if you have not done so yet):
We recommend that customers rotate credentials that are either used to access Sumo Logic or that you have provided to Sumo Logic to access other systems.
Specifically, we advise you to rotate immediately:
What you could also rotate as an additional precautionary measure:
———
WE NO LONGER RECOMMEND THE FOLLOWING MEASURES FOR THIS INCIDENT:
———
If you have questions about steps to take, don't hesitate to get in touch with our customer support team at https://support.sumologic.com/support/s/.
November 9, 2023: 2:00PM PST
Per the recommendations mentioned in the November 7th & 8th Security Notices, we have created a playbook to guide our customers through the process of updating their API access keys.
Here is a direct link to the playbook: link
The information contained in this website is provided “as is,” without any warranty of any kind, either express or implied. Users are solely responsible for adequate protection and backup of the data and equipment used in connection herewith. If Users require assistance, please contact our Support team via opening a ticket using our Support Console.
November 8, 2023
As an outcome of our ongoing investigation, we are reducing the scope of the additional precautionary measures mentioned in our November 7th message. Here is the updated recommendation:
What you could also rotate as an additional precautionary measure:
November 7, 2023
To Our Valued Customers:
At Sumo Logic, ensuring the security and reliability of our customers’ digital experience is our top priority. We have always placed great emphasis on protecting our customers against threats, and we understand and deeply value the trust our customers place in us.
To that end, we are writing to notify you, as a precautionary measure, of a possible security incident within our platform.
WHAT HAPPENED:
On Friday, November 3rd, 2023, Sumo Logic discovered evidence of a potential security incident. The activity identified used a compromised credential to access a Sumo Logic AWS account. We have not at this time discovered any impacts to our networks or systems, and customer data has been and remains encrypted.
WHAT HAVE WE DONE:
Immediately upon detection we locked down the exposed infrastructure and rotated every potentially exposed credential for our infrastructure out of an abundance of caution. We are continuing to thoroughly investigate the origin and extent of this incident. We have identified the potentially exposed credentials and have added extra security measures to further protect our systems. This includes improved monitoring and fixing any possible gaps to prevent any similar events and we are continuing to monitor our logs to look for further signs of malicious activity. We have taken actions to stop the threat to our infrastructure and are advising customers to rotate their credentials.
WHAT SHOULD YOU DO:
We recommend that customers rotate credentials that are either used to access Sumo Logic or that you have provided to Sumo Logic to access other systems. Specifically:
What we advise you rotate immediately:
Sumo Logic API access keys (If you need assistance with this, please contact Sumo Support at https://support.sumologic.com/support/s/)
What you could also rotate as an additional precautionary measure:
Sumo Logic installed collector credentials
Third-party credentials that have been stored with Sumo for the purpose of data collection by the hosted collector (e.g., credentials for S3 access)
Third-party credentials that have been stored with Sumo as part of webhook connection configuration
User passwords to Sumo Logic accounts
If you have questions about steps to take, please do not hesitate to contact our customer support team at https://support.sumologic.com/support/s/
WHAT HAPPENS NEXT:
While the investigation into this incident is ongoing, we remain committed to doing everything we can to promote a safe and secure digital experience.
We will directly notify customers if evidence of malicious access to their Sumo Logic accounts is found. Customers may find updates at our Security Response Center.
Your security remains our top priority and we want to reiterate how much we value you putting your trust in us. Thank you for your understanding through this process.
October 26, 2023
Sumo Logic is aware of the vulnerability CVE-2023-44487, also known as "HTTP/2 Rapid Reset Attack.” Sumo Logic has mitigations in place that we inherit from AWS mechanisms. We do not believe we are susceptible based on our scanning, testing, and inherited mitigations from our AWS-based infrastructure. We have followed the current guidance published by AWS in this regard.
October 26, 2023
Last month Google published CVE-2023-5129 (marked as a duplicate) and CVE-2023-4863 indicating vulnerabilities existed within libwebp and as a result within a number of downstream applications leveraging it. Sumo Logic has updated all applicable systems to ensure we are not vulnerable and are continuing to monitor our corporate security posture as well as our third-party vendors to ensure they are dealing with the situation as appropriate.
September 28, 2023
Sumo Logic is aware of the vulnerabilities (CVE-2023-5129 and CVE-2023-4863) that Google published indicating a critical vulnerability in libwebp. We are actively investigating to identify any and all areas where we may be leveraging the vulnerable versions of this library. As of now our investigations have revealed no indications of compromise. We will keep this page up to date as our investigations continue.
June 20, 2023
Sumo Logic is aware of the published vulnerabilities (CVE-2023-34362, CVE-2023-35036, and CVE-2023-35708) by Progress software indicating that the MOVEit Transfer tool was vulnerable to multiple SQL injection vulnerabilities. Our investigation suggests that Sumo Logic is not impacted as our products and services do not use MOVEit Transfer tool. Our current assessment is that no action is required from our customers, but we will continue to monitor and update as appropriate.
Nov 4, 2022
Sumo Logic is aware of the recently announced OpenSSL vulnerabilities (CVE-2022-3786 and CVE-2022-3602). Our initial investigation suggests that Sumo Logic is not impacted as our products and services do not rely on OpenSSL. Our current assessment is that no action is required from our customers, but we will continue to monitor and update as appropriate.
April 1, 2022
Sumo Logic has validated that we do not use any part of the vulnerable Spring Cloud framework found in CVE-2022-22963. We have also reviewed CVE-2022-22965 and have validated that Sumo Logic is not vulnerable to known exploitable methods. Out of an abundance of caution, we will be updating our Sumo Logic Service; however, no action is required on your part. The Sumo Logic collector is not vulnerable to known Spring Cloud framework exploitation methods.
March 31, 2022
Sumo Logic is aware of CVE-2022-22963, which is an exploitable Remote Code Execution (RCE) in Spring Cloud Functions. Our initial investigation suggests that Sumo Logic is not impacted. Our current assessment is that no action is required on your part at this time, but we will continue to monitor and keep you posted as our analysis progresses.
Our Global Operations Center investigated Okta’s evolving situation as Sumo Logic currently leverages Okta's federated identity solution. So far we have no evidence that Sumo Logic, our employees or services are impacted in any way.
Beginning early in the morning on Dec. 10th, Sumo Logic’s security team investigated and validated the nature and severity of the exploit against potential points of compromise and determined that at NO time was Sumo Logic exploited.
We use a custom SumoLog4Layout library that never invokes custom lookups (as compared to Apache Log4j) so the Sumo Logic Service was never impacted.
Summary:
A support engineer's laptop at the Identity and Authentication (IAM) firm, Okta was compromised
Are Sumo Logic customers impacted?
Our Global Operations Center investigated Okta’s evolving situation and so far we have no evidence that Sumo Logic, our employees or services are impacted in any way.
What can I do?
Customers and prospects in a currently 30-day trial can use the Okta app to determine if they are compromised and leverage Cloud SIEM targeted searches.
Actively monitoring current threats in real-time to ensure customers are not impacted
Creating easy-to-copy search queries and filters customers can use to determine if they are at risk
Providing security-specific onboarding to prospects in our 30-day trial to help them determine if they are compromised.
Start a 30 Day trial
Leverage our application integrations and log ingesting capabilities to determine if your organization has been compromised
Talk to our security experts
Take a tour of our security capabilities and Cloud SIEM. Our team can walk you through common threat response scenarios and how to build pro-active threat monitoring.
