ECC Log4j vulnerability

[SteveCap]

We have released an updated for the ECC ServerMananger to fix this issue. The ServerManager auto updates and should be in place. For the fix to be applied to the Java BSFN server it will need to be restarted.

To do this open the ECC ServerManager and for each environment go to the JDE Server tab and click restarted. Wait a minute and the ProcessId should update.

Screenshot 2021-12-13 112119.png (19.18 KiB) Viewed 3142 times

Screenshot 2021-12-13 112119.png (19.18 KiB) Viewed 3142 times

----------- 4.8 and Lower BSFN Server Instructions ----------------------------

To apply this fix in the BSFN server directly, go to the scheduled task on the APP server to check the currently running BSFN servers.

-If the scheduled task is running the Java command directly, you need to edit the scheduled task.
-If the scheduled task is running the BSFNServerStartupFile.cmd or some other .cmd startup file, you need to edit the startup file.

The edit should insert the -Dlog4j2.formatMsgNoLookups=true arg in the JVM args as shown below:

Java\jdk\bin\java.exe -Xms256m -Xmx512m -Dlog4j2.formatMsgNoLookups=true -cp includes\*;..\JDEBSFN_JDEJarFiles\*;..\jdk\jre\lib\rt.jar;json-smart-1.2.jar;log4j.jar; JDEBSFNServer JAVABSFNSERVER ENV APP [] [] SEVERE