Log4j security vulnerability with SAP Crystal Reports for .NET SDK

[dave_smith2]

We were just made aware of a severe vulnerability in the Java logging library Apache Log4j.

See the following article for more information:

https://www.zdnet.com/article/security-warning-new-zero-day-in-the-log4j-java-library-is-already-bei...

Is this library present and being used by the Crystal Reports runtime engine for .NET SDK (using v13.0.30.3805)? If so, what measures can we take to mitigate this vulnerability? Is SAP planning to issue some kind of patch?

Thanks in advance.

[tomaslov]

Thanks alot!

[cherylmathieu]

Thank you!

[dave_smith2]

Thank you, but this article only refers to SAP Business Objects BI Platform 4.2x.

How does this vulnerability affect the SAP Crystal runtime for .NET and/or Crystal Reports itself?

Has SAP looked into those components and is there any indication as to whether or not they are affected?

[dmjohnston]

I also need to have this answered specifically for the SAP Crystal Runtime. Why is this kind of information behind the S-account wall, anyway?

[laxmi_b]

There are lot of files with Name *\Log4j-1.2.15.jar and Log4j.jar in the SAP Business Objects 4.3 implementation. Can SAP give a more detailed answer on the version of all the Log4j files?

[edwardtam]

I also need to have this answered specifically for the SAP Crystal Reports 2016. Could anyone please share the related info somewhere more open to us who need this?

[alexhart]

https://logging.apache.org/log4j/2.x/security.html

[Joe_Peters]

Interesting - the last bullet point (about updating to 2.15) was just removed from the page.

[ayman_salem]

You are right, SAP updates the KBA regularly (now version 5)

[dmjohnston]

As others have noted, Ayman, the OP, and others here, are asking about the impact to Crystal Reports, which is different than the Business Objects BI platform.

[dave_smith2]

And what about the SAP Crystal runtime for .NET? Is that mentioned in this KBA?

How can we access this document? We do not have an S-user id and are prevented from seeing it.

[former_member11696 · Accepted solution]

Hi John,

The important part about all of these issues is the classes in log4j that have the issue is not included in the SAP versions so not sure about the scanner you are using and if it looks for the specific class definition or just the file/versions.

The only version that was affected is in CR for Eclipse and that one we just released SP 28 to fix the issue with the updated log4j jar version 2.17.1

https://wiki.scn.sap.com/wiki/display/BOBJ/SAP+Crystal+Reports+version+for+Eclipse+-+Downloads

Use Google and search for this KBA 3131199 for CR for Eclipse.

You will need to contact Sage to see if and when they provide a fix or answer.

I don't believe you'll be able to delete the files, the instal manifest file will put it back on if it detects it missing.

Just be assured our version does not include the class with the vulnerability so it's not an issue.

Hope that clears things up for everyone.

Don