Summary & Key Actions Required

• Avantra Server (master)
  • Upgrade your server (master) to either:
    • 21.11.2+
    • 20.11.11+
    • [manual mitigation] If you are on any other version of Avantra server and you cannot upgrade you will need to follow some manual steps as per the version-specific guidance documents below.
• UI Server (xangui)
  • Upgrade your UI server (xangui) to either:
    • 21.11.2+
    • 20.11.11+
    • [manual mitigation] If you are on any other version of UI server (xangui) and you cannot upgrade you will need to follow some manual steps as per the version-specific guidance documents below.
• Agent
  • Upgrade your agent to either:
    • 21.11.2 - requires master server version 21.11.0 or above
    • 20.11.11 - requires master server version 20.11.9+ and SAP transports 20.11.9+
    • 20.11.702 - requires master server version 20.11.7+ and SAP transports 20.11.2 - 20.11.7)
    • 20.5.8 - requires master server 20.5.6+
    • For agents that cannot be upgraded - advice is given in the version-specific documents below for how to manually update the configuration to mitigate the issue.

Version specific guidance documents:

• Avantra 21.11.0 and above (servers or agents)
• Avantra 20.11.x and above (servers or agents)
• Avantra 20.5 / 20.2 and below

Related security articles:

• CVE-2021-45046 - Log4j2 Thread Context Message/Lookup
• CVE-2021-45105 - Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
• CVE-2021-44228 - Custom Check - verify Avantra has been hardened
• CVE-2021-44228 - Sample code - agent configuration changes - linux
• Avantra Hardening Guide

CVE-2021-44228 Summary

A security vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j 2 utility was disclosed publicly via the project’s GitHub on December 9, 2021. The vulnerability impacts Apache Log4j 2 versions 2.0 to 2.14.1. The vulnerability allows for unauthenticated remote code execution.

Java 8u121 helps protect against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false" and this is the current recommendation to mitigate the risk prior to application update publication. However, in our testing, this does not fully mitigate the issue.

See https://nvd.nist.gov/vuln/detail/CVE-2021-44228 for more details on this Vulnerability.

Impact to Avantra

The following is a list of Server and Agent components that are affected by this CVE

• Avantra 21.11.0 uses Log4j 2.14.1
• Avantra 20.11.0 - 20.11.9 uses Log4j 2.14.0
• Avantra 20.5.0 - 20.5.6 use Log4j 2.5
• Avantra 20.2.x, 7.3.x, 7.2.x use Log4j 2.5
• Avantra 7.1.x uses Log4j 2.3

We are aware that this exploit is an immediate issue for customers that have configured Active Directory integration and these customers are advised to apply the fixes as soon as possible.

Change Log

We, at Avantra, take the security of our software and our customers very seriously and it is our top priority. We will keep you up to date as more information becomes available and encourage customers to subscribe to the security section of our forum to get proactive updates as we post them.