FlexNet Embedded Knowledge Base

This article is an extension of the Log4j security advisory and serves to consolidate impact and mitigation details of related Log4j vulnerabilities with regards to FlexNet Embedded.  FlexNet Embedded Product Assessment: Component CVE Potential Exposure Fixed Version Mitigation Resources FlexNet Embedded License Server Manager CVE-2021-44228 Yes (2020.10 or later) 2021.12.2 KB article   CVE-2021-45046 Yes (2020.10 or later) 2021.12.2 KB article   CVE-2021-45105 Yes (2020.10 or later) 2021.12.2 KB article   CVE-2021-44832 No N/A N/A   CVE-2021-4104 No N/A N/A   CVE-2019-17571 No N/A N/A   CVE-2022-23302 No N/A N/A   CVE-2022-23305  No N/A N/A   CVE-2022-23307  No N/A N/A   CVE-2020-9493 No N/A N/A   CVE-2020-9488 No N/A N/A FlexNet Embedded License Server CVE-2021-44228 No N/A N/A   CVE-2021-45046 No N/A N/A   CVE-2021-45105 No N/A N/A   CVE-2021-4104 Yes  N/A KB article   CVE-2019-17571 No N/A KB article   CVE-2022-23302  Yes  N/A KB article   CVE-2022-23305  Yes  N/A KB article   CVE-2022-23307 No N/A N/A   CVE-2020-9493 No N/A N/A   CVE-2020-9488 Yes  N/A KB article FlexNet Embedded SDK CVE-2021-44228 No N/A N/A   CVE-2021-45046 No N/A N/A   CVE-2021-45105 No N/A N/A   CVE-2021-4104 No N/A N/A   CVE-2019-17571 No N/A N/A   CVE-2022-23302 No N/A N/A   CVE-2022-23305 No N/A N/A   CVE-2022-23307 No N/A N/A   CVE-2020-9493 No N/A N/A   CVE-2020-9488 No N/A N/A  

Summary A vulnerability identified as CVE-2021-44228 has been reported in the Apache Log4j library. This vulnerability may allow for remote code execution in susceptible products. Problem Description Upon analysis, CVE-2021-44228 has been determined to impact the optional FlexNet License Server Manager (FLSM) component packaged with the FlexNet Embedded local license server. Resolution Revenera has provided a FlexNet Embedded 2021.12 local license server that does not contain the FlexNet License Server Manager component. This updated package is available for download on the Product and License Center. A separate FlexNet License Server Manager (FLSM) package that does not use the vulnerable Log4j component is available for download from the Product and License Center. The package files are: For Windows For Linux flexnet-flsm-windows-2021.12.2.zip flexnet-flsm-linux-2021.12.2.tar.gz Workaround We advise customers to temporarily cease using the FlexNet License Server Manager until the new package is available. However, customers who wish to continue using the FlexNet License Server Manager may mitigate risk by including Dlog4j2.formatMsgNoLookups=true to JAVA_OPTS environment variable in Tomcat CATALINA_HOME/bin  directory: Operating System Directions Windows Edit setenv.bat and append "-Dlog4j2.formatMsgNoLookups=true" if exists. If it doesn't exist, create new file and add set JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" Linux Edit setenv.sh in CATALINA_HOME/bin and append "-Dlog4j2.formatMsgNoLookups=true" if exists If this doesn't exist, create a new file and add export JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" Additional Information CVE Definition: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Expanded CVE Definition: https://www.cve.org/CVERecord?id=CVE-2021-44228 Apache Security Site for CVE severity, score, and vector string: https://logging.apache.org/log4j/2.x/security.html

New to FlexNet Embedded and not sure where to start? Then this article is for you! In this guide, we outline your next steps in order to have a successful journey with the FlexNet Embedded product.  Obtain Your Producer Information Upon purchasing FlexNet Embedded, you should have received two emails from Revenera:  Order Confirmation email: This email not only contains your organization's order information, but it also contains your organization's [Account ID] and [Product ID] details required to register for the Revenera Community. Note: Registering on the Revenera Community with your Account ID and Product ID, as well as approved access to the Product and License Center, is mandatory to download the FlexNet Embedded product and its resources.  Production Keys email: This email contains your organization's producer information (vendor and vendor keys) required to build your FlexNet Embedded licensed application and other licensing components.  Access the Product and Other Product Resources 1. Register for the Revenera Community Using the Account ID and Product ID details from the order confirmation email, sign up for the Revenera Community. Check out our Welcome to the Revenera Community help article for more information. 2. Get access to the Product and License Center If you are the original recipient of the order confirmation email, you were automatically designated your organization's Product and License Center Administrator (PLC Admin). With the PLC Admin role, you can manage Product and License Center access for your team members once they sign up for the community. This can be done using the Product and License Center User Administration page. If you were not the original recipient of the order confirmation email, you will need to sign up for the community and request access from your PLC Admin. If you do not know who in your organization has the PLC Admin role, please contact Revenera Technical Support for assistance. 3. Download the product Once you've gained access to the Product and License Center, navigate to Product List -> FlexNet Licensing -> FlexNet Embedded. From here you can download the FlexNet Embedded local license server and toolkit by platform.  4. Access product documentation Download the FlexNet Embedded developer related documentation. This is available on the Product and License Center under Product List -> FlexNet Licensing -> FlexNet Embedded -> FlexNet Embedded Documentation. For license server administration documentation, visit the FlexNet Embedded section of the Documentation Site. Prepare Your Producer-Specific Resources Follow the instructions in the following documents to install and prepare your producer-specific FlexNet Embedded resources: Toolkit: FlexNet Embedded User Guide (platform-specific) Local license server: FlexNet Embedded License Server Producer Guide If you plan to use FlexNet Embedded with FlexNet Operations, you must create your producer/producer identity within FlexNet Operations. Please see the Getting Started with FlexNet Embedded Licensing section of the FlexNet Operations User Guide for more information. Stay Up to Date Be sure to subscribe to the FlexNet Embedded News blog to receive product release and other important notifications. You can also subscribe to the Software Monetization Release Schedule* to keep track of upcoming FlexNet Embedded releases. *Note: Requires community login Learn More or Get Help The Revenera Community offers a variety of resources to learn about the FlexNet Embedded product: Search the FlexNet Embedded Knowledge Base for how-to, faq, and problem type articles. The Revenera Learning Center* currently hosts several training videos and recordings from our live customer events.  If you run into a problem or have questions, you can use the following resources: Post a question on the FlexNet Embedded Forum* and learn from your peers and other FlexNet Embedded product experts. Open a new case online using the Get Support -> Open New Case* form.  *Note: Requires community login

This article documents the FlexNet Embedded release highlights introduced each year, starting from 2020 R3 (2020.07) to present: 2023.05: CLS + LLS Cloud Licensing Service + Local License Server Introduced user-based licensing for producers who want to license software applications or services based on the number of users that can access or use them. Producers who use FlexNet Embedded in combination with FlexNet Operations as their back office can now limit or prohibit binding-break repairs on the local license server. Resolved issue around badly formatted hostids. 2023.03.01: LLS Local License Server Resolved issue with service shutdown mechanism 2023.03: CLS + LLS Cloud Licensing Service + Local License Server License server administrators can now use regular expressions when creating rules of access for license pools (previously referred to as “partitions”). Resolved time zone conversion issue for /features endpoint Posting model definition using flexnetlsadmin no longer fails Local License Server The performance of the local license server has been increased, which results in faster processing of capability requests. 2023.02: CLS + LLS Licensing Server The open source component Spring Boot has been updated to version 2.7.7.  The LatencyUtils package has been removed from the Micrometer component. Sending a capability request after mapping add-ons or features no longer results in a 503 error. 2023.01: CLS + LLS Licensing Server The response to the /access_request and /signed_access_request endpoints of the Cloud Monetization API (CMAPI) now includes the value of the Notice field.  In the license server REST API, a new query parameter includeUsageExpiry can return the date and time when a feature expires on the client.  The naming pattern for the access log file has changed. Using the max keyword in a partition which contains features of the same name but of different versions no longer results in unpredictable behavior. 2022.12: CLS + LLS Licensing Server If several features are available for checkout that only differ in their expiry date, the license server now serves the feature with the shortest expiry which also satisfies the borrow period. The install-systemd.sh install script can now be used to install a server certificate. The License Server Producer Guide includes a new appendix “Workflow Example for Producer-Defined Binding”, with step-by-step instructions to help producers set up binding on a local license server. Updated open-source components: commons-text Jackson databind logback Spring Boot Updated Swagger documentation 2022.11: CLS + LLS Licensing Server New keyword for feature partitions: Producers and license administrators can use the max keyword to limit the number of feature counts that a single user or device can consume. The API documentation for the local license server is now generated using SpringDoc (OpenAPI 3). 2022.10: CLS + LLS Licensing Server Calling the /partitions endpoint using GET now also returns partitions that contain no feature counts. A new property server.hostType.order enables producers to specify the order in which the local license server picks the hostid type. Client information returned by the flexnetlsadmin command -licenses -verbose is no longer truncated. 2022.09: CLS + LLS Licensing Server Preview requests no longer include orphans Resolved an issue where unsynced usages were deleted during synchronization LLS Linux install now honors an externally-specified JAVA_HOME or JRE_HOME variable Self-contained server is no longer supported and will no longer be shipped with the license server 2022.08: CLS + LLS Licensing Server The Cloud Monetization API (CMAPI) responses for the /access_request and /signed_access_request endpoints can now include the renewInterval field. Updated open-source component Spring Boot A new -restore-service-database command restores trusted storage at the service mode installation location (Linux). Resolved an issue with incorrect feature counts which could occur after a license server update. 2022.07: CLS + LLS Licensing Server Model definitions can now include partitions that have a feature count of 0. This enables producers to upload a model definition that functions as a template, which can be updated with feature counts at a later date. A new -restore-service-database command restores trusted storage at the service mode installation location (Windows only). 2022.06: CLS + LLS Cloud Licensing Service Cloud Monetization API enhancement: Capability requests sent to the /access_request or /signed_access_request endpoint support passing multiple values per key. This enables producers who use feature partitions to allocate licenses to users who belong to multiple groups. Updated open-source components Spring Boot and Liquibase Resolved issue with flexnetlsadmin’s -licenses command Resolved issue with /clients REST endpoint, which now correctly returns all current clients after synchronizing licensing information with the back office Local License Server Updated open-source components Liquibase and jackson-databind 2022.05: LLS Licensing Server Cloud Monetization API enhancement: Capability requests sent to the /access_request or /signed_access_request endpoint support passing multiple values per key. This enables producers who use feature partitions to allocate licenses to users who belong to multiple groups. Updated open-source component Spring Boot Resolved issue with flexnetlsadmin’s -licenses command Resolved issue with /clients REST endpoint, which now correctly returns all current clients after synchronizing licensing information with the back office 2022.04: CLS + LLS Licensing Server Support for Windows 11 2022.03: CLS + LLS Licensing Server Resolved an issue with preview requests using the RequestAll flag. The issue occurred when the license server was provisioned with multiple line items that had different expiry dates, where one of the line items had expired. Minimized blackout time during synchronization with back office Improved error message wording when --service-shutdown option is used for a license server running in a console window 2022.02: CLS + LLS + Client Kits Licensing Server Logging in the license server is now done with Logback, not log4j Added a new configuration property for cipher choice mechanism Resolved flexnetlsadmin communication issue with local license server when a .local URL is used Counts are now updated correctly when a client sends parallel requests to a Cloud Licensing Service instance Client Kits FlexNet Embedded Client kits now offer support for Microsoft Windows 11 platform Java XT TRA: Log4j 1 no longer bundled with tra-run.jar and tra-gen.jar .Net XT SDKs: Optimized GetFeatureCollection call to enable more efficient handling of capability responses containing large quantities of features C XT SDK: Optimized virtualization detection (Linux only) Identity update utility now includes container_id in types list Updated third-party components (OpenSSL, LibCurl) 2022.01: CLS + LLS Licensing Server FlexNet License Server Manager now available in the Product and License Center as a separate package Enhanced logic of distributing used feature counts in feature partitions Customers can now pass vendor dictionary values using the /preview_request API Resolved issue where used counts were not updated correctly if a client tried to renew licenses when the corresponding feature is part of a reactivated line item “rate-limit” setting no longer causes flexnetlsadmin command -licenses -verbose to fail Resolved issue where local license server could crash on installation 2021.12: CLS + LLS Licensing Server Allowed size of model definition for partitions has been increased to 900KB Increased performance of POST requests on /rules endpoint New /features/summaries endpoint returns a summary of available features, grouped by feature name Remodeled logic for returning used license counts to resolve issue of incorrectly calculated counts Resolved issue where preview requests and capability requests for features with overdraft counts were not working as expected Resolved issue with flexnetlsadmin’s -licenses option for uncapped metered features Resolved issue affecting the sorting of checkout filter features 2021.11: CLS + LLS Licensing Server A new directive “vendor string matches” enables license administrators to allocate feature counts to partitions based on variables specified in the vendor string. After use, feature counts are returned to their original partition. The /clients API no longer returns inconsistent results when queried with and without the hostid parameter 2021.10: CLS + LLS Licensing Server User-based reservations are now working as expected 2021.09: LLS + Client Kits Licensing Server New support for Ubuntu 20.04 LTS Reservations are no longer automatically converted to partitions, resolving a compatibility issue where the conversion of reservations into rules could lead to incorrect license counts in the resulting partitions References to Jackson-databind 2.2.3 have been removed from OfflineSync tools Resolved issue where licenses could be available for checkout from a cloned local license server Capability response utility capresponseutil now supports the optional parameter enterpriseId Client Kits References to Jackson-databind 2.2.3 have been removed from OfflineSync tools Resolved false-positive tamper detection issue 2021.07: CLS + LLS Licensing Server Producers can now disable the creation of access logs by setting server.accessLogPattern=none in producer-settings.xml. The wording of log entries for rejected capability requests has been improved. Entries now indicate when a request has been denied due to a feature partitions rule rejection. The response to a call of the /health endpoint now includes a new trustStatus property, which indicates whether a trust break has occurred. Resolved an issue where license counts in partitions were not correctly re-allocated after an updated model definition was uploaded to the license server. 2021.06: CLS + LLS Licensing Server New licensing.defaultTimeZone setting to configure the timezone the server uses to determine feature expiry date, start date, and issue dates Resolved license count handling when the reservation group or partition is deleted while the count is in use Resolved license count handling when reservation groups are deleted and recreated with different feature counts Fixed license leakage issue when feature counts change while features are checked out 2021.05: CLS + LLS + Client Kits Licensing Server Fixed OptimisticLockRefreshException error when adding a new reservation entry Failover synchronization issues have been resolved Increase in failover database size issue is fixed Third-party software modules have been upgraded Client Kits New support for macOS ARM Resolved calendar issues for Java XT kits C-XT kit no longer crashes if year exceeds 3001 on Windows platform Vulnerability CWE-327 addressed 2021.04: CLS + LLS Licensing Server Conditional operator support added to Feature Partitioning rules Resolved issue preventing reserved counts from being automatically renewed Fixed license count issue caused by reservations groups repeatedly being deleted/created Changed mechanism for local license server-FlexNet Operations HTTPS communciation 2021.03: CLS + LLS Licensing Server New streaming interface /clients and /features endpoints to query large client tables, hence improving the performance Resolved VMUUID detection issue on Google Compute Cloud (Windows only) for LLS The REST API /clients endpoint now returns the served clients when the borrow interval was set to 0s on both CLS and LLS Resolved time zone conversion issue for feature expiry on both CLS and LLS The issue with borrow granularity unit is now fixed 2021.02: CLS + LLS Licensing Server Support for JSON-format Logging on the Local License Server (LLS) Integration of LLS Logging with External Systems like Graylog, Elastic Stack Fixed the synchronization issue in failover scenario Improved performance for querying /clients endpoint for both LLS and CLS Fixed the trailing slash in JAVA_HOME system environment variable in LLS Correct version of OpenSSL reported in the LLS A number of third-party software modules used in the FlexNet License Server Manager have been upgraded. 2021.01: CLS + LLS Licensing Server New activeOnly query parameter has been introduced for /features endpoint for both CLS and LLS Return of counts for multiple activation IDs with identical expiry date issue has been fixed on CLS Resolved client expiry issues on CLS Support for PKCS #12 keystores in LLS Resolved VM_UUID detection issue on Google Compute Cloud for LLS Resolved MAC address issue related to hostid case sensitivity. 2020 R3 SP3(2020.12): CLS + LLS + Client Kits Licensing Server License activation using REST API and .NET on both LLS and CLS Usage reports could show duplicate rows with a feature count value of zero for every checked in feature is fixed on CLS Enhanced the model definition upload using the /rules API for long list of hostids—containing 10,000 hostids on both LLS and CLS Used feature counts correctly returned to license pool after effective borrow interval expired Updated open source third party components and dependencies have been removed Resolved flexnetlsadmin to CLS communication issue Fixed the issue that caused error while running local license server(LLS) in console mode Client Kits Improved Cloud Platform detection which fixes the that occasionally detect and return an incorrect hostid value for VM_UUID Resolved VM_UUID detection issue on Google Compute Cloud Releasing of system resource 2020 R3 SP2(2020.10): CLS + LLS + Client Kits Licensing Server Springfox-Swagger has been upgraded to version 2.9.2 in both LLS and CLS. This upgrade addresses potential security issues. Spring Boot has been upgraded to version 2.1.2 in both LLS and CLS to address potential security issues. Enhanced Logging Functionality on the Local License Server. A new logging style configuration parameter has been introduced for the LLS, to configure timestamp behaviour. Resolved below FlexNet License Server Administrator Issues “-reset” command resets the security.enabled policy back to its original default value set by the producer. “-licenses” command now returns correct feature count “-licenses -verbose” command now returns correct value for available counts A number of third-party software modules used in the FlexNet License Server Manager have been upgraded Client Kits Fix for potential memory leak (Linux XT only) 2020 R3 SP1 Hotfix(2020.07.1): CLS only Licensing Server Feature counts are now consumed from correct activation id. For metered features, counts could be consumed from an incorrect activation ID. This issue was due to a change in the sequence of returning used counts. Resolved Client Expiry Timer issue Fixed incorrect expiry date 2020 R3(2020.07): CLS + LLS + Client Kits Licensing Server Feature Partitions The maxCount field now indicates how many counts of a feature are available, regardless of how many counts have been requested. The active hostid set using FlexNet License Server Manager or using the REST APIs now persists in the database. It is no longer necessary to reset it after a server reboot Improved FlexNet License Server Administrator Output Resolved REST API pagination issue CLS performance improvement Resolved server borrow interval issue Updated open source component Jackson Databind in FlexNet License Server Manager In the FlexNet License Server Manager user interface added new Start Date column and New Device Alias column Client Kits Identical Correlation ID generation issue has been addressed (C XT SDKs only) Resolved issue related to connecting to server via proxy (C XT SDKs on macOS only). Resolved issues with redirected URLs (.NET XT SDKs only). Amazon AWS EC2 detection no longer causes XT client crashes (XT SDKs only)