CVE-2021-44228: Log4j vulnerability impact on FlexNet Embedded
Summary
A vulnerability identified as CVE-2021-44228 has been reported in the Apache Log4j library. This vulnerability may allow for remote code execution in susceptible products.
Problem Description
Upon analysis, CVE-2021-44228 has been determined to impact the optional FlexNet License Server Manager (FLSM) component packaged with the FlexNet Embedded local license server.
Resolution
Revenera has provided a FlexNet Embedded 2021.12 local license server that does not contain the FlexNet License Server Manager component. This updated package is available for download on the Product and License Center.
Note: You must have permission to access the Product and License Center. This would be granted to you by either Revenera or by your company's administrator.
A separate FlexNet License Server Manager (FLSM) package that does not use the vulnerable Log4j component is available for download from the Product and License Center. The package files are:
| For Windows | For Linux |
|---|---|
| flexnet-flsm-windows-2021.12.2.zip | flexnet-flsm-linux-2021.12.2.tar.gz |
Workaround
We advise customers to temporarily cease using the FlexNet License Server Manager until the new package is available. However, customers who wish to continue using the FlexNet License Server Manager may mitigate risk by including Dlog4j2.formatMsgNoLookups=true to JAVA_OPTS environment variable in Tomcat CATALINA_HOME/bin directory:
| Operating System | Directions |
|---|---|
| Windows |
Edit setenv.bat and append "-Dlog4j2.formatMsgNoLookups=true" if exists. If it doesn't exist, create new file and add set JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" |
| Linux |
Edit setenv.sh in CATALINA_HOME/bin and append "-Dlog4j2.formatMsgNoLookups=true" if exists If this doesn't exist, create a new file and add export JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" |
Additional Information
- CVE Definition: https://nvd.nist.gov/vuln/detail/CVE-2021-44228
- Expanded CVE Definition: https://www.cve.org/CVERecord?id=CVE-2021-44228
- Apache Security Site for CVE severity, score, and vector string: https://logging.apache.org/log4j/2.x/security.html
