Issue with Hotfix installation for Pega 7 Hotfix Advisory for Apache Log4j Zero Day
As part of Log4j Zero-Day Vulnerability, we received the DL-9857_HF-56867 for 7.3.1.
After installing DL, the status of a few hotfixes says "Partially Installed"?. Is something needs to be checked .
Updated: 20 Jan 2022 7:26 EST
Pegasystems Inc.
GB
Hello @BRAHMESH@
This issue has been found recently and is due to a problem with the CATALOG file used to report on installed hotfixes (BUG-699529).
The hot fixes are installed successfully. The issue with the system scanner showing them as partially installed is an issue with the catalog. The new catalog should be available in the next few days and then you will be able to rescan your environments and see them show as installed. This should not be stopping you from installing these hot fixes in your environments.
These hot fixes have installed correctly but the following classes (which are not part of the hot fix) are showing as not installed and thus the hot fixes still show on the critical missing list as they are appearing as partially installed.
| DefaultObjectInputFilter.class | log4j-api-2.12.3.jar | org.apache.logging.log4j.util.internal |
| StackLocator$FqcnCallerLocator.class | log4j-api-2.12.3.jar | org.apache.logging.log4j.util |
| module-info.class | log4j-api-2.12.3.jar |
Engineering team is working on fixing the catalog and soon an updated catalog will be made available, and that can be used to run a new scan of the environments to get the critical hot fixes to show as being installed.
I hope this helps.