Wiki

Scale Your Enterprise

User Tools

Site Tools

Trace: • kb_item_364
kb:kb_item_364

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
kb:kb_item_364 [2021/12/16 11:40]
mneuendorff 		kb:kb_item_364 [2021/12/17 08:51] (current)
mneuendorff
Line 1: Line 1:
 +**Log4Shell (Log4j2) Vulnerability
 +**
 +
 What is Log4Shell? What is Log4Shell?
 Log4Shell is a high severity vulnerability (CVE-2021-44228, CVSSv3 10.0) impacting multiple versions of the Apache Log4j 2 utility. It was disclosed publicly via the project’s GitHub on December 9, 2021. This vulnerability, which was discovered by Chen Zhaojun of Alibaba Cloud Security Team, impacts Apache Log4j 2 versions 2.0 to 2.14.1. The vulnerability allows for unauthenticated remote code execution. Log4j 2 is an open-source Java logging library developed by the Apache Foundation. Log4j 2 is widely used in many applications and is present, as a dependency, in many services. These include enterprise applications as well as numerous cloud services. Log4Shell is a high severity vulnerability (CVE-2021-44228, CVSSv3 10.0) impacting multiple versions of the Apache Log4j 2 utility. It was disclosed publicly via the project’s GitHub on December 9, 2021. This vulnerability, which was discovered by Chen Zhaojun of Alibaba Cloud Security Team, impacts Apache Log4j 2 versions 2.0 to 2.14.1. The vulnerability allows for unauthenticated remote code execution. Log4j 2 is an open-source Java logging library developed by the Apache Foundation. Log4j 2 is widely used in many applications and is present, as a dependency, in many services. These include enterprise applications as well as numerous cloud services.
Line 8: Line 11:
 At this time, SAP continues to investigate the remote code execution vulnerability (CVE-2021-44228) related to Apache Log4j disclosed on Dec 10, 2021. SAP encourages our customers to update to the latest version of Log4j, where applicable. Currently, SAP does not have a workaround for SAP Business One. SAP Business One is currently in a Patch Pending status with SAP. Most of the SAP Business One Apache/Java applications are internal only. These include System Landscape Directory, Job Server, Service Layer, etc. Since they are internal only, this appears to reduce the vulnerability risk.  At this time, SAP continues to investigate the remote code execution vulnerability (CVE-2021-44228) related to Apache Log4j disclosed on Dec 10, 2021. SAP encourages our customers to update to the latest version of Log4j, where applicable. Currently, SAP does not have a workaround for SAP Business One. SAP Business One is currently in a Patch Pending status with SAP. Most of the SAP Business One Apache/Java applications are internal only. These include System Landscape Directory, Job Server, Service Layer, etc. Since they are internal only, this appears to reduce the vulnerability risk. 
  
 +{{ :kb:b1update.png?400 |}}
 +
 +**
 +{{ :kb:3131789_-_mitigate_log4j_cve-2021-44228_vulnerability_in_sap_business_one.pdf |Download Mitigation Document}}** 
kb/kb_item_364.1639672821.txt.gz · Last modified: 2021/12/16 11:40 by mneuendorff

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial 4.0 International
CC Attribution-Noncommercial 4.0 International Valid HTML5 Valid CSS Driven by DokuWiki