Is SAP BUSINESS ONE AFFECTED BY CVE-2021-44228

[yakoair1]

We are receiving some questions (very worried customers) about this particular component.
Is SAP BUSINESS ONE affected?


Apache Log4j JNDI Lookup Remote Code Execution Vulnerability / A vulnerability exists in Apache Log4j due to insufficient restrictions placed on the JNDI lookup functionality. An attacker could exploit this vulnerability to execute arbitrary code on vulnerable systems

[former_member598991]

The latest update by SAP is visible under the following link:

https://support.sap.com/content/dam/support/en_us/library/ssp/my-support/trust-center/sap-tc-01-5025...

[yakoair1]

Dear everybody I suggest not to share this document yet be aware that the document is marked as confidential and asks for an NDA even.

[rahuljain257]

Sure Gabriela.

[yakoair1]

sap note has been released

https://launchpad.support.sap.com/services/pdf/notes/3131789/E

3131789 - Mitigate Log4j CVE-2021-44228 Vulnerability in SAP Business One

[JesperB1 · Accepted solution]

Hello,

Just released - A new SAP Knowledge Based Article (KBA) (Note 3131789) is created which outlines our awareness and a workaround of this in the SAP Business One context.

Jesper

[AngeloZ · Accepted solution]

Hello Jesper,

Do other versions of SAP B1 not mentioned in the KBA is not affected by the Log4j vulnerability?

Thank you.

Angelo

[patelyogesh]

Hello gabriela.lpez2,

Patch Pending = SAP Business One

Please find more information at the link below.

sap-tc-01-5025.pdf

Thank you

Yogesh