{"id":44343,"date":"2022-01-10T14:06:11","date_gmt":"2022-01-10T14:06:11","guid":{"rendered":"https:\/\/compliancenow.eu\/?p=44343"},"modified":"2023-03-31T13:06:13","modified_gmt":"2023-03-31T13:06:13","slug":"compliancenow-and-the-log4j-vulnerability","status":"publish","type":"post","link":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/","title":{"rendered":"ComplianceNow and the Log4j vulnerability"},"content":{"rendered":"

Potential risks in their own system landscape. ComplianceNow has performed a thorough analysis of our products and found that the log4j has been used in certain versions of our software. We have reached out to all our affected customers directly, but for additional information on how the log4j component has been used and which actions are needed to secure the ComplianceNow suite we have compiled this information.<\/p>\n

Summery<\/h2>\n

On December 9, 2021, a new critical 0-day vulnerability impacting multiple versions of the popular Apache Log4j 2 logging library was publicly disclosed that, if exploited, could result in Remote Code Execution (RCE) by logging a certain string on affected installations.<\/p>\n

This specific vulnerability has been assigned CVE-2021-44228 and is also being commonly referred to as “Log4Shell” in various blogs and reports. Versions of the library said to be affected are versions 2.0-beta 9 to 2.14.1<\/p>\n

Impact<\/h2>\n

The log4j library is actively used in the ComplianceNow suite for minor operations. The affected versions of the ComplianceNow suite are version 5.2.6 releases between and including 10945 and 11688.<\/p>\n

The log4j library is not directly available through any web requests and is only used internally in the code when generating Excel files, which is done in a separate sandboxed process. We have not been able to replicate any such attack on our servers and does not consider ComplianceNow installations exposed. We do however encourage that the libraries are updated to a version that does not contain the mentioned exploit, so everyone can rest easy knowing that the flawed code is not even present on the server.<\/p>\n

How would I know if I am affected?<\/h2>\n

If you are using either Authorization Process Manager (APM), Usage Monitor (UM), Access Control (AC) or Internal Control (IC) you can access the application to verify your actual application version. The \u201cabout\u201d tab which is the first view of the application, contains the version and release numbers.<\/p>\n

The version is the first number and the release is the number encapsulated by paranthesis.<\/p>\n\n\n

\"\"<\/figure>\n\n\n

Protection<\/h2>\n

ComplianceNow has been working on identifying a solution that will ensure no vulnerabilities exist in the ComplainceNow server located on your premises. The resolution will need to be performed by following the steps below:<\/p>\n

    \n
  1. Identify the current log4j libraries in your application folder
    \\ComplianceNow\\CNSuite\\Java\\lib\\apache\\<\/li>\n
  2. Delete the 2 files from the folder
    log4j-api-2.14.0.jar
    log4j-core-2.14.0.jar<\/li>\n
  3. Download the log4j version 2.17.1 files and unpack them to the same folder
    https:\/\/acsol-packages.s3.eu-west-1.amazonaws.com\/3rdParty\/ComplianceNow-log4j-2.17.1.zip<\/a><\/li>\n
  4. Restart the Apache service on your server<\/li>\n<\/ol>\n

    Additional information<\/h2>\n

    https:\/\/logging.apache.org\/log4j\/2.x\/security.html<\/a><\/p>\n

    If you have any further questions, don’t hesitate to contact our support team.<\/p>\n

    Sincerely,
    ComplianceNow<\/p>\n

    Interested to learn more\u2026.?<\/h2>\n

    We always look forward presenting our CN Suite to present customers, possible new customers, partners and network. So, if you want to learn more, have questions or would like to see a live demo of CN Suite<\/strong><\/a> please contact us.<\/p>\n\n\n

    \n\n\n\n

    <\/p>\n\n\n

    Follow us on LinkedIn<\/strong><\/a> and get instant access to our latest articles and posts on SAP and compliance.<\/p>\n\n\n

    \"ComplianceNow<\/figure>\n","protected":false},"excerpt":{"rendered":"

    In the last couple of days companies have become aware of the log4j vulnerability and started investigating any potential risks in their own system landscape. ComplianceNow has performed a thorough analysis of our products and found that the log4j has been used in certain versions of our software. We have reached out to all our affected customers directly, but for additional information on how the log4j component has been used and which actions are needed to secure the ComplianceNow suite we have compiled this information.<\/p>\n","protected":false},"author":31,"featured_media":47604,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[16],"tags":[],"class_list":["post-44343","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"yoast_head":"\nLog4j vulnerability and ComplianceNow<\/title>\n<meta name=\"description\" content=\"ComplianceNow has performed a thorough analysis of our products and found that the log4j vulnerability has been used in certain versions of..\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Log4j vulnerability and ComplianceNow\" \/>\n<meta property=\"og:description\" content=\"ComplianceNow has performed a thorough analysis of our products and found that the log4j vulnerability has been used in certain versions of..\" \/>\n<meta property=\"og:url\" content=\"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"ComplianceNow\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-10T14:06:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-31T13:06:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/01\/ComplianceNow-and-the-Log4j-vulnerability.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1613\" \/>\n\t<meta property=\"og:image:height\" content=\"850\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"victorandersen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"victorandersen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/\"},\"author\":{\"name\":\"victorandersen\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#\\\/schema\\\/person\\\/bc9271e4cb2f3c41bf53973a4ae42e05\"},\"headline\":\"ComplianceNow and the Log4j vulnerability\",\"datePublished\":\"2022-01-10T14:06:11+00:00\",\"dateModified\":\"2023-03-31T13:06:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/\"},\"wordCount\":517,\"publisher\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/compliancenow.eu\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/ComplianceNow-and-the-Log4j-vulnerability.png\",\"articleSection\":[\"blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/\",\"url\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/\",\"name\":\"Log4j vulnerability and ComplianceNow\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/compliancenow.eu\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/ComplianceNow-and-the-Log4j-vulnerability.png\",\"datePublished\":\"2022-01-10T14:06:11+00:00\",\"dateModified\":\"2023-03-31T13:06:13+00:00\",\"description\":\"ComplianceNow has performed a thorough analysis of our products and found that the log4j vulnerability has been used in certain versions of..\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#primaryimage\",\"url\":\"https:\\\/\\\/compliancenow.eu\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/ComplianceNow-and-the-Log4j-vulnerability.png\",\"contentUrl\":\"https:\\\/\\\/compliancenow.eu\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/ComplianceNow-and-the-Log4j-vulnerability.png\",\"width\":1613,\"height\":850,\"caption\":\"ComplianceNow and the Log4j vulnerability\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/blog\\\/compliancenow-and-the-log4j-vulnerability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Homepage\",\"item\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ComplianceNow and the Log4j vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/\",\"name\":\"ComplianceNow\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#organization\",\"name\":\"ComplianceNow\",\"url\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/compliancenow.eu\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/complianceNow-90x30mm-petrol.png\",\"contentUrl\":\"https:\\\/\\\/compliancenow.eu\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/complianceNow-90x30mm-petrol.png\",\"width\":951,\"height\":253,\"caption\":\"ComplianceNow\"},\"image\":{\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/compliancenow\\\/mycompany\\\/?viewAsMember=true\",\"https:\\\/\\\/vimeo.com\\\/compliancenow\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCf7DCjsPffbpPgvD-TqayGw\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/compliancenow.eu\\\/en\\\/#\\\/schema\\\/person\\\/bc9271e4cb2f3c41bf53973a4ae42e05\",\"name\":\"victorandersen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/55388b93e4830502bf5003d1f7e1b5bf07cefa548d5e1229f2600bfc66808b72?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/55388b93e4830502bf5003d1f7e1b5bf07cefa548d5e1229f2600bfc66808b72?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/55388b93e4830502bf5003d1f7e1b5bf07cefa548d5e1229f2600bfc66808b72?s=96&d=mm&r=g\",\"caption\":\"victorandersen\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Log4j vulnerability and ComplianceNow","description":"ComplianceNow has performed a thorough analysis of our products and found that the log4j vulnerability has been used in certain versions of..","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"Log4j vulnerability and ComplianceNow","og_description":"ComplianceNow has performed a thorough analysis of our products and found that the log4j vulnerability has been used in certain versions of..","og_url":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/","og_site_name":"ComplianceNow","article_published_time":"2022-01-10T14:06:11+00:00","article_modified_time":"2023-03-31T13:06:13+00:00","og_image":[{"width":1613,"height":850,"url":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/01\/ComplianceNow-and-the-Log4j-vulnerability.png","type":"image\/png"}],"author":"victorandersen","twitter_card":"summary_large_image","twitter_misc":{"Written by":"victorandersen","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#article","isPartOf":{"@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/"},"author":{"name":"victorandersen","@id":"https:\/\/compliancenow.eu\/en\/#\/schema\/person\/bc9271e4cb2f3c41bf53973a4ae42e05"},"headline":"ComplianceNow and the Log4j vulnerability","datePublished":"2022-01-10T14:06:11+00:00","dateModified":"2023-03-31T13:06:13+00:00","mainEntityOfPage":{"@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/"},"wordCount":517,"publisher":{"@id":"https:\/\/compliancenow.eu\/en\/#organization"},"image":{"@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/01\/ComplianceNow-and-the-Log4j-vulnerability.png","articleSection":["blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/","url":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/","name":"Log4j vulnerability and ComplianceNow","isPartOf":{"@id":"https:\/\/compliancenow.eu\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/01\/ComplianceNow-and-the-Log4j-vulnerability.png","datePublished":"2022-01-10T14:06:11+00:00","dateModified":"2023-03-31T13:06:13+00:00","description":"ComplianceNow has performed a thorough analysis of our products and found that the log4j vulnerability has been used in certain versions of..","breadcrumb":{"@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#primaryimage","url":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/01\/ComplianceNow-and-the-Log4j-vulnerability.png","contentUrl":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/01\/ComplianceNow-and-the-Log4j-vulnerability.png","width":1613,"height":850,"caption":"ComplianceNow and the Log4j vulnerability"},{"@type":"BreadcrumbList","@id":"https:\/\/compliancenow.eu\/en\/blog\/compliancenow-and-the-log4j-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Homepage","item":"https:\/\/compliancenow.eu\/en\/"},{"@type":"ListItem","position":2,"name":"ComplianceNow and the Log4j vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/compliancenow.eu\/en\/#website","url":"https:\/\/compliancenow.eu\/en\/","name":"ComplianceNow","description":"","publisher":{"@id":"https:\/\/compliancenow.eu\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/compliancenow.eu\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/compliancenow.eu\/en\/#organization","name":"ComplianceNow","url":"https:\/\/compliancenow.eu\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/compliancenow.eu\/en\/#\/schema\/logo\/image\/","url":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/12\/complianceNow-90x30mm-petrol.png","contentUrl":"https:\/\/compliancenow.eu\/wp-content\/uploads\/2022\/12\/complianceNow-90x30mm-petrol.png","width":951,"height":253,"caption":"ComplianceNow"},"image":{"@id":"https:\/\/compliancenow.eu\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/compliancenow\/mycompany\/?viewAsMember=true","https:\/\/vimeo.com\/compliancenow","https:\/\/www.youtube.com\/channel\/UCf7DCjsPffbpPgvD-TqayGw"]},{"@type":"Person","@id":"https:\/\/compliancenow.eu\/en\/#\/schema\/person\/bc9271e4cb2f3c41bf53973a4ae42e05","name":"victorandersen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/55388b93e4830502bf5003d1f7e1b5bf07cefa548d5e1229f2600bfc66808b72?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/55388b93e4830502bf5003d1f7e1b5bf07cefa548d5e1229f2600bfc66808b72?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/55388b93e4830502bf5003d1f7e1b5bf07cefa548d5e1229f2600bfc66808b72?s=96&d=mm&r=g","caption":"victorandersen"}}]}},"_links":{"self":[{"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/posts\/44343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/comments?post=44343"}],"version-history":[{"count":0,"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/posts\/44343\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/media\/47604"}],"wp:attachment":[{"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/media?parent=44343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/categories?post=44343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/compliancenow.eu\/en\/wp-json\/wp\/v2\/tags?post=44343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}