In December 2021, SAP released comprehensive security updates primarily focused on the critical Log4Shell (CVE-2021-44228) remote code execution vulnerability. This flaw, affecting the Apache Log4j 2 library, presented a severe risk to enterprise environments, requiring immediate patching and mitigation across multiple SAP solutions.
Understanding the Log4Shell Vulnerability (CVE-2021-44228)
Log4Shell is a critical vulnerability in the Apache Log4j 2 logging utility, which is widely bundled within SAP software. It allows an unauthenticated attacker to remotely execute arbitrary code on a vulnerable system.
- Vulnerability Details: Log4j versions 2.14.1 and lower enabled remote message lookup substitution via the Java Naming and Directory Interface (JNDI) API.
- Risk Level: With a maximum CVSS score of 10.0/10.0, the vulnerability requires no privileges or user interaction for successful exploitation.
- SAP Response: SAP released central note 3131047 to consolidate patches across the SAP ecosystem, covering products like SAP HANA XS Advanced (XSA) Runtime, Process Orchestration, and Landscape Management.
Which SAP solutions were impacted?
As of late December 2021, SAP provided patches for several high-priority products. Organizations running the following solutions were advised to prioritize updates:
- SAP HANA XS Advanced (XSA) Runtime & Cockpit
- SAP Process Orchestration
- SAP Landscape Management
For other solutions—including SAP Business One, SAP Commerce, SAP PowerDesigner, and SAP Web IDE for HANA—SAP provided patches or interim workarounds via Knowledge Based Articles (KBA) while permanent fixes were finalized.
Summary of December 2021 SAP Security Updates
| Focus Area | Vulnerability Type | Impact |
|---|---|---|
| Log4j 2 (Log4Shell) | Remote Code Execution | Critical (CVSS 10.0) |
| JNDI API | Remote Message Lookup | Potential System Compromise |
| SAP Bundled Components | Software Supply Chain | High Priority |
Frequently Asked Questions
Why is Log4Shell considered one of the most dangerous vulnerabilities?
Log4Shell is dangerous because it can be exploited remotely with minimal complexity and without authentication. It allows attackers to execute arbitrary code, potentially leading to the complete compromise of the underlying application or server.
What should I do if a patch is not yet available for my SAP solution?
For SAP products where a patch is not immediately available, SAP provides guidance and workarounds through Knowledge Based Articles (KBAs). Administrators should check the SAP Support Portal regularly for updates related to their specific product versions.
How does the JNDI API contribute to the Log4Shell vulnerability?
The JNDI API in older versions of Log4j allowed dynamic values to be retrieved from remote sources by default. Attackers exploited this behavior to force the application to fetch and execute malicious code from an external server.