SUPPORT COMMUNICATION - SECURITY BULLETIN – MF Connect

Potential Security Impact: remote code execution

VULNERABILITY SUMMARY

Two potential vulnerabilities have been identified in the Apache log4j library used by MF Connect.

The vulnerability could be exploited to allow remote code execution.

CVE References: CVE-2021-44228, CVE-2021-45046

SUPPORTED SOFTWARE VERSIONS (ONLY impacted versions are listed):

MF Connect – all versions up to and including 4.4.1

CVSS Version 3.1 Metrics:

RESOLUTION:

Hotfix 7 for MF Connect 4.4.1 addresses both vulnerabilities by using log4j-core-2.16.0.
Please download from the MF Connect Core marketplace page and carefully read and follow the accompanying install instructions: https://marketplace.microfocus.com/appdelivery/content/micro-focus-connect-core

If you are using an older version of MF Connect, we strongly urge you to upgrade as soon as possible. If this is not possible, please refer to the attached document for mitigation guidance.

For the latest mitigation guidance, please refer to https://logging.apache.org/log4j/2.x/security.html.

DOCX