Apache log4j usage

[AEshelman]

Does anyone know -

If SAP uses log4j with SuccessFactors

If they do is used on all set ups/platform packages

If they are using it have they patched for log4j to CVE-2021-44228 vulnerability

If they haven't yet does anyone know how long until they do?

This is a somewhat urgent matter, so hoping someone has some more info that the generic response I got from support this morning.

Thank you!!!

Amber

[Sword_mb]

I need to know this as well. What was the generic answer you received?

[amontella96]

Hi aeshelman4ku

as you know there are not yet news about SuccessFactors but to answer your question , once all the notes dedicated to the different products will be out, sap will probably sent an email to customers (as the one that went out already for CPI) or update below link or lastly create a landing page note

https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/trust-center/sap-tc-01-5025...

follow the most voted link here 🙂

[amontella96]

Hi aeshelman4ku

i think 3131450 should address your latest question. Good luck! A

[AEshelman]

That they are aware and are working on it and will update via normal channels, but I do not know where those updates will happen or when...so am hoping for more data.

Thanks!!