[UPDATED]Alert: DocuSign statement on the Log4j2 vulnerability

12/11/2021

[UPDATED: December 17, 2021, 5:19 PM PST] DocuSign has been actively working on assessing risk and treating affected assets since the vulnerability was initially disclosed on the morning of December 9.

As of December 17, DocuSign continues to observe no indicators of compromise in our environment from Log4j2. DocuSign has previously deployed and continues to enhance countermeasures consistent with recently published CISA guidance to provide layers of protection and increased situational awareness through regular monitoring and blocking of suspicious activity. As a federal contractor, we are also complying with Emergency Directive 22-02 released on 12/17.

DocuSign has engaged all of our suppliers for a comprehensive risk assessment and will work with our suppliers to ensure they have mitigations in place and are updating their software or services to remediate this issue. As this situation continues to evolve, we will implement additional remediation actions as appropriate.

As of 12/17, DocuSign can confirm that the following services have been addressed and are not vulnerable to Log4j2.

Product	Status
eSignature	Product is not affected by CVE-2021-44228, CVE-2021-45046.
CLM	Product is affected by CVE-2021-44228, CVE-2021-45046. All configurations have been treated and are not vulnerable.
InSight	Product is affected CVE-2021-44228, CVE-2021-45046. All configurations have been treated and are not vulnerable.
LiveOak	Product is not affected by CVE-2021-44228, CVE-2021-45046.
Rooms	Product is affected by CVE-2021-44228, CVE-2021-45046. All configurations have been treated and are not vulnerable.

DocuSign would like to re-emphasize the severity of the Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046 and CVE-2021-4104), whereby the zero day allows malicious actors to craft a payload that can trigger the execution of arbitrary code on application servers, and DocuSign is responding accordingly. The Log4j library is used extensively in Java-based solutions industry-wide and not limited to DocuSign Services.

We encourage you to perform an assessment of your specific endpoint implementations for use of the Log4j service, including third-party services. This CISA article provides more detail into the issue.

Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.

[POSTED: December 16, 2021, 2:57 PM PST] As of December 16, DocuSign continues to observe no indicators of compromise in our environment from Log4j2. DocuSign has previously deployed and continues to enhance countermeasures consistent with recently published CISA guidance to provide layers of protection and increased situational awareness through enhanced monitoring and blocking of suspicious activity. We continue to reach out to our third-party suppliers providing critical DocuSign operations to determine their impact and status of remediation and patching activities.

Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.

[POSTED: December 15, 2021, 4:12 PM PST] As of December 15, DocuSign continues to observe no indicators of compromise in our environment from Log4j2. DocuSign has previously deployed and continues to enhance countermeasures consistent with recently published CISA guidance to provide layers of protection and increased situational awareness through enhanced monitoring and blocking of suspicious activity. We continue to reach out to our third-party suppliers providing critical DocuSign operations to determine their impact and status of remediation and patching activities.

Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.

[POSTED: December 14, 2021, 8:25 PM PST] DocuSign continues to observe no indicators of compromise in our environment from Log4j2. DocuSign has previously deployed and continues to deploy countermeasures consistent with recently published CISA guidance. DocuSign continues to monitor information provided by CISA, threat intelligence and other vendors and will respond accordingly.

Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.

[POSTED: December 13, 2021, 12:00 PM PST] DocuSign has observed no indicators of compromise in our environment from Log4j2. Countermeasures are in place to provide layers of protection and increase situational awareness through enhanced monitoring and blocking of suspicious activity. We have reached out to our third-party suppliers providing critical DocuSign operations to determine their impact and status of remediation and patching activities.

The security of our products is a top priority and critical to our ongoing commitment of fostering trust and transparency for our customers. DocuSign continues to monitor information provided by CISA, threat intelligence and other vendors for new information. We will continue to take prompt action as necessary.

Please visit https://docusign.com/trust/alerts for the latest updates regarding this alert.

[POSTED: December 11, 2021, 11:00 AM PST] On December 9, 2021, DocuSign security and engineering teams received intelligence of the Log4j2 vulnerability (CVE-2021-44228) and initiated investigations. DocuSign is patching or mitigating as vulnerable configurations are identified.

As of December 11, 2021, DocuSign has observed no indicators of compromise in the environment or to customers.

DocuSign continues to investigate and monitor the situation as it evolves with any new information.