SAP neo SDK - log4j security issue in Java Applications

[#1]

Update 2021-12-16:

Keep an eye on this SAP source for ongoing updates!

Shortcut to latest State of Document:
https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/trust-center/sap-tc-01-5025...

---------

Dear community,

the security vulnerability of the Log4J framework is attracting a lot of attention.
We are just wondering if neoSDK is also affected by this vulnerability.

Java Web Tomcat 8:
First investigations showed that e.g. neoSDK version 3.80.13 uses Log4J version 1.2.16.
Also in the newest 3.142.7 it seems, that there is Log4J 1.2.16 used.

Java Web Tomcat 9:

According to heise.de, 1.2.x versions should not be affected.

So we assume that there is no need for action.
Do we understand this correctly?

Alternatively, and to be on the safe side, the following JVM argument could also be specified at application startup to disable the malicious functionality

–Dlog4j2.formatMsgNoLookups=True

Attention: The application must be restarted for this.

The configuration can be done via the BTP Cockpit:

[Removed by the moderator.]

Thanks and many greetings

Mario

Disclaimer: This is not safety advice and I take no responsibility for its accuracy.

[mario_guenter91 · Accepted solution]

In short, do the following:

Check SAP’s Response to CVE-2021-44228 Apache Log4j Vulnerability:

And there use the information provided at:

- logging API cannot be changed

- Reboot of applications required

[ThomasRauen]

Hi Mario,
not sure if it is that easy.
On the vendors page there is a line that basically says that 1.2.x is deprecated and with that not checked for vulnerabilities...
https://logging.apache.org/log4j/2.x/security.html

Regards

Thomas

[mario_guenter91]

Hi Thomas,

I agree, that 1.2.x is deprecated, basically. But it seems it is not affected by CVE-2021-44228.
Are you facing the same problem? What would you recommend?

Generally I recommend follow SAP Notes and keep Log4J updated with versions higher or equal to 2.15:

More information:

• https://launchpad.support.sap.com/#/solutions/notesv2/?q=CVE-2021-44228
• https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2021/2021-549032-10F2.pdf?__blob=pub...

Additionally - as stated above:
I am wondering if we understand correctly, that it seems there is no action required as long as NEO SDKs seem to bring its own libraries / dependencies by default (including log4j) - if not manually defined/overwritten in pom.xml.

SAP states the following at the moment:

• https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/trust-center/sap-tc-01-5025...

For security reasons it could be reasonable to add mentioned D-Parameter in NEO Java Applications and restart them.

Best Regards,
Mario

[ThomasRauen]

Hi Mario,

you're right but apparently there is another issue with an older one CVE-2019-17571
I think it takes the pressure from the current topic, but still something that should be clarified immediately...

The log4j is part of the runtime environment that you can select while deploying a java app,
that's why we assume that it is always part of an app...

You can download and check the runtime environment from the tools.hana.ondemand.com site.
under Cloud neo runtime environment, there it's part of all the latest packages...

Regards

Thomas

[mario_guenter91]

Hi Thomas,

I think we are of the same opinion. As also pointed out in the main post (see screenshots), even in the latest version(s) an outdated Log4J version is in use.

This can't stay like this in the long run and should be solved quickly.
We hope for a solution or recommended action from SAP to also replace the outdated version with a secure version.

Thank you and best regards
Mario