Severity: Critical

Description: The Apache Log4j Java logging library that is included with Platform LSF is affected by the vulnerabilities that are described in the following CVE records:

• CVE-2021-44228
• CVE-2021-44832
• CVE-2021-45046
• CVE-2021-45105

Note: Platform LSF versions 10.1.0.6 and later are affected by Apache Log4j vulnerabilities.

Platform LSF 10.1.0.12 includes the vulnerability fixes. If the Apache Log4j vulnerabilities still appear in scans for Platform LSF 10.1.0.12 and the Platform LSF resource connector is not enabled, then remove the following files:

            /LSF_TOP/10.1/resource_connector/*/lib/log4j-core-2.14.1.jar

            /LSF_TOP/10.1/resource_connector/*/lib/log4j-api-2.14.1.jar

Note: Platform LSF is vulnerable only if a resource connector is enabled (disabled by default)

Important: Before you apply the Platform LSF patch that is associated with this note, perform the following step:

• Review the guidance that is provided in the following SAS Security Bulletin: SAS Statement Regarding Remote Code Execution Vulnerability (CVE-2021-44228). 

Click the Downloads tab in this note to access the patch for this issue.

Operating System and Release Information

Note: To remove the vulnerability for Apache Log4j in Platform LSF 10.1.0.6, install the E3K002 patch.

Note: To remove the vulnerability for Apache Log4j in Platform LSF 10.1.0.9, install the K3L003 patch.