Summary

A vulnerability identified as CVE-2021-44228 has been reported in the Apache Log4j library. This vulnerability may allow for remote code execution in susceptible products.

Problem Description

Upon analysis, CVE-2021-44228 has been determined to impact the optional FlexNet License Server Manager (FLSM) component packaged with the FlexNet Embedded local license server.

Resolution

Revenera has provided a FlexNet Embedded 2021.12 local license server that does not contain the FlexNet License Server Manager component. This updated package is available for download on the Product and License Center.

Note: You must have permission to access the Product and License Center. This would be granted to you by either Revenera or by your company's administrator.

A separate FlexNet License Server Manager (FLSM) package that does not use the vulnerable Log4j component is available for download from the Product and License Center. The package files are:

Workaround

We advise customers to temporarily cease using the FlexNet License Server Manager until the new package is available. However, customers who wish to continue using the FlexNet License Server Manager may mitigate risk by including Dlog4j2.formatMsgNoLookups=true to JAVA_OPTS environment variable in Tomcat CATALINA_HOME/bin directory:

Additional Information

• CVE Definition: https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• Expanded CVE Definition: https://www.cve.org/CVERecord?id=CVE-2021-44228
• Apache Security Site for CVE severity, score, and vector string: https://logging.apache.org/log4j/2.x/security.html