This is an old revision of the document!
Log4Shell (Log4j2) Vulnerability
What is Log4Shell? Log4Shell is a high severity vulnerability (CVE-2021-44228, CVSSv3 10.0) impacting multiple versions of the Apache Log4j 2 utility. It was disclosed publicly via the project’s GitHub on December 9, 2021. This vulnerability, which was discovered by Chen Zhaojun of Alibaba Cloud Security Team, impacts Apache Log4j 2 versions 2.0 to 2.14.1. The vulnerability allows for unauthenticated remote code execution. Log4j 2 is an open-source Java logging library developed by the Apache Foundation. Log4j 2 is widely used in many applications and is present, as a dependency, in many services. These include enterprise applications as well as numerous cloud services.
Does this affect any Third Wave software? Since this vulnerability only affects applications using Log4j, the open-source Java logging library, it does NOT affect any Third Wave software.
Does this affect SAP software? At this time, SAP continues to investigate the remote code execution vulnerability (CVE-2021-44228) related to Apache Log4j disclosed on Dec 10, 2021. SAP encourages our customers to update to the latest version of Log4j, where applicable. Currently, SAP does not have a workaround for SAP Business One. SAP Business One is currently in a Patch Pending status with SAP. Most of the SAP Business One Apache/Java applications are internal only. These include System Landscape Directory, Job Server, Service Layer, etc. Since they are internal only, this appears to reduce the vulnerability risk.
