Question
Deutsche Post AG
DE
Last activity: 28 Jan 2022 8:35 EST
When will hotfix log4j 2.17.1 come?
Last week in https://docs-previous.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability#2.17.1 the hotfix was announced for the 14.1.2022 and I already prepared the deployment.
On the 14th the date was changed to "the week of January 17, 2022".
Now it is friday and I cannot find the hotfix. Is there any reliable date when the hotfix will come?
Deutsche Post AG
DE
Thanks to Pooja for adding the tag.
Nevertheless after the date given last week, again a week is gone. And I haven't got any reply to this question. It seems that no one knows if and when this hotfix will be released.
Deutsche Post AG
DE
And still nobody seems to have any information about the release date of the hotfix for log4j 2.17.1. In the meantime I raised an SR. But after days besides of triaging nothing happens to this SR.
I would appreciate if there is any news regarding this topic.
Pegasystems Inc.
NL
Hi Michael,
We apologize for the delay and outdated advisory information.
The mentioned hotfix in the end did actually get released on the 17th, however there was no advisory update. I see that you have received the files in the meantime through support. I've submitted a request to update the advisory. Please feel free to directly provide us feedback on a specific doc or community article through the yellow 'contact us' option on the right hand side at any time, to further allow us to improve.
Please note that the criticality of this hotfix is debatably. If you've already applied the earlier hotfixes, there's most likely no risk left which requires this 2.17.1 log4j based hotfix. There's a high chance there's more direct security benefits by focusing on other aspects of your Pega security.
I hope this answers your questions and you can mark this question as addressed. Please reach out to me directly in case you'd like assistance in identifying other opportunities to improve security of your Pega applications.
Kind regards,
Eric Rietveld
Deutsche Post AG
DE
Besides of this question I also raised an SR which was also not answered. I am not willing to accept that it takes a week to answer a simple question. Especially if I understand from other questions that Pega did not inform anybody that the hotfix was released. And this morning I was running the hotfix manager and this hotfix was still not in the catalogue. But now Pega cloud team started to install the hotfix on my environments.
You may debate if this hotfix is needed or not. But it is a mandatory requirement of IT-Security in our company. They don't do any compromises on security.