Question Re: Is SQL Anywhere affected by Apache Log4j vulnerability? in Technology Q&A

Is SQL Anywhere affected by Apache Log4j vulnerability?

Breck_Carter — Sat, 11 Dec 2021 10:00:56 GMT

Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit

Re: Is SQL Anywhere affected by Apache Log4j vulnerability?

Vlad — Sat, 11 Dec 2021 13:27:37 GMT

https://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.help.sqlanywhere.12.0.1/sachanges/newinnsbruck-sectc-3789111.html

MobiLink server no longer requires log4j.jar The log4j.jar file is no longer required by the MobiLink server and is no longer deployed with the MobiLink server. If you require log4j.jar you must install your own version of the jar and put it in the classpath.

My blind guess - no. But you can check if your server still uses log4j.jar as a dependency.

Re: Is SQL Anywhere affected by Apache Log4j vulnerability?

Breck_Carter — Sat, 11 Dec 2021 13:37:40 GMT

Thanks... it doesn't appear to ship with SA16 or SA17, but it's a different story with ASE 16

Re: Is SQL Anywhere affected by Apache Log4j vulnerability?

chris_keating — Mon, 13 Dec 2021 09:16:17 GMT

SQL Anywhere 17 is not affected by this vulnerability.

Re: Is SQL Anywhere affected by Apache Log4j vulnerability?

VolkerBarth — Mon, 13 Dec 2021 09:38:03 GMT

What about v16? (It's EOL'ed, I'm aware...)

Re: Is SQL Anywhere affected by Apache Log4j vulnerability?

former_SQLA_member326303 — Fri, 29 Apr 2022 05:04:40 GMT

The SAP note ("3130849 - CVE-2021-44228 - RCE 0-day exploit found in log4j - SQL Anywhere") states that: "... Note that versions of SQL Anywhere older than 17.0 are not being maintained. If this CVE is a concern, you should upgrade to SQL Anywhere 17.0."

Can you please tell me if there is any information about "zero-day/Log4j2"-vulnerability for SQL Anywhere 16.0.0 and SQL Anywhere 12.0.1?

Re: Is SQL Anywhere affected by Apache Log4j vulnerability?

Breck_Carter — Sat, 30 Apr 2022 10:07:44 GMT

AFAIK log4j.jar didn't ship with SQL Anywhere after version 11.