nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Apache Log4j vulnerability - CVE-2021-44228

mromano

Hyland's security team is aware of the Apache Log4j vulnerability, and they are actively investigating whether any of Hyland's products or internal systems are vulnerable. The security of our products and systems are a top priority, and we appreciate your patience as we determine whether Hyland or its products are impacted. You can expect more updates to be shared here as we learn more.

UPDATE 2021-12-15: More information about this vulnerability now available here: https://hub.alfresco.com/t5/alfresco-content-services-blog/cve-2021-44228-related-to-apache-log4j-security-advisory/ba-p/310717

Find more posts tagged with

Alfresco Content Services

Comments

mromano

Hyland conducted an initial review of Alfresco and determined there is no impact by the Apache Log4j vulnerability: https://community.hyland.com/en/blog/posts/82098-apache-log4j-security-advisory#74224cdb-eec9-4dd4-bfa7-7d852d1af771

GerhardSA

Good day,

Could the information linked to here https://hub.alfresco.com/t5/alfresco-content-services-blog/apache-log4j-vulnerability-cve-2021-44228/ba-p/310661 not be made available here?

abby

@mromano Not able to access the link that you have posted, can you please share the details here? Tried to sign up but the activation link goes to a page not found.

arasales

I can't get de information through the links that you posted. Please give us information, it is very important for my company.

ryotawatabe

I coud not login...

qchevalier

Hi,

On this link https://connect.hyland.com/t5/hyland-r-d-blog/cve-2021-4104-related-to-apache-log4j-security-advisory/ba-p/385808 the Alfresco part redirects on this topic. In my comprehension they do not give information about alfresco products for this vulnerability.

There is the alfresco part on the link...

"Alfresco

Please review the latest update available on the Alfresco Hub."

niekheuvink

After the initial review as stated by "mromano": Hyland conducted an initial review of Alfresco and determined there is no impact by the Apache Log4j vulnerability.

Is there already more information available? Can we guarantee 100% no impact? And what about the new CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046

saidone

@niekheuvink AFAIK Alfresco still rely on Log4j 1.x that according to Apache is susceptible only to:

CVE-2021-4104

and is relevant only if "the attacker has write access to the Log4j configuration".

clemenspape

Alfresco Capture aka Ephesoft Transact:
https://ephesoft.com/docs/products/transact/announcements/product-announcements/log4j-vulnerability/

Transact On-Premise users versions 4.5-2020.1.06:

Please read the following instructions before applying the patch.

DCerv

Update: More information available on this vulnerability here: https://hub.alfresco.com/t5/alfresco-content-services-blog/cve-2021-44228-related-to-apache-log4j-security-advisory/ba-p/310717