Hybris SAP Commerce Cloud - Log4j Vulnerability Solution

The Log4j vulnerability is the most high-profile security vulnerability on the internet right now and comes with a severity score of 10 out of 10. I hope by now you are already aware of Log4j Vulnerability (CVE-2021-44228). Hence, In this article, I'll not cover more about what log4j vulnerability is.

Now let's talk about what is the quick solution or precautionary measures for the SAP Commerce Hybris.


If your Hybris solution is on-premise or with SAP Infrastructure (CCV1) then you should take preventive measures either removing JNDI classes from existing log4j-core-*.jar or upgrading all log4j libs. As of now, let's go with the first option which looks like a quick and easy fix to me.

1) Create /hybris/config/customize/platform/ext/core/lib folder structure in your project

2) Copy /hybris/bin/platform/ext/core/lib/log4j-core-.jar* file to /hybris/config/customize/platform/ext/core/lib

3) Go to /hybris/config/customize/platform/ext/core/lib and execute below two commands which exclude Jndi classes.

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/net/JndiManager.class

 

4) Your lib is ready to use. You can commit this jar to the code repository (Git) 

5) Make sure to execute the below command during the hybris build process in all the environments. This will override the Hybris OOTB log4j-core-*.jar 

ant customize


If you are using SAP Cloud Commerce CCV2, I think you do not need to take any action for Log4J. However, please consult with your implementation/license partner.

Source: https://launchpad.support.sap.com/#/notes/0003130982
Author Image

Ankitkumar Patel

Sr. SAP Hybris consultant, having 15+ years experience in SAP Commerce Cloud (Hybris), SAP Spartacus. Extensive experience in SAP Hybris development, third-party integrations, project architecture and design... Read more

Comments

Post a Comment

Popular posts from this blog

Hybris flexible search query examples

Use of Enum in the query Find all running Solr Index jobs select {cj.code},{enum:code},{cj.startTime},{cj.endTime} from { SolrIndexerCronJob! as cj join EnumerationValue as enum on {cj.status}={enum.pk} } where {enum:code} = 'RUNNING' Compare Date in the flexiblesearch query Find all running Solr Index jobs from the given date select {cj.code},{enum:code},{cj.startTime},{cj.endTime} from { SolrIndexerCronJob! as cj join EnumerationValue as enum on {cj.status}={enum.pk} } where {enum:code} = 'RUNNING' and {cj.startTime} >= TO_DATE('2021/12/25','YYYY/MM/DD') Basic  JOIN  and  IN  query Get the most recent order for each customer using flexible search. select {o.code} as orderCode, {c.name} as name, {a.cellphone} as cellphone from {order as o join Customer as c on {c.pk} = {o.user} join Address as a on {o.deliveryaddress} = {a.pk} } where {o.code} in ({{select max({cod...
Read more

How to Install temporary Hybris license?

LICENSE VERIFICATION HAS FAILED! Your demo/develop license has expired, it is valid only for 30 days. How to install temp SAP Hybris license? Don't worry, you can install a temporary license. To install a temporary license 1) Remove  installedSaplicenses.properties  from the license folder \hybris\config\licence 2) Go to the Platform directory and run the  ./license.sh -temp CPS_SQL  or  license.bat -temp CPS_SQL . If you are using DB other than HSQL you can choose the right command based on your DB.   Windows run  license.bat  instead of  ./license.sh OOTB HSQL DB ./license.sh -temp CPS_SQL MySQL DB ./license.sh -temp CPS_MYS Oracle DB ./license.sh -temp CPS_ORA SQL Server DB ./license.sh -temp CPS_MSS SAP Hana DB ./license.sh -temp CPS_HDB Once you install using the above command, You will get a message like First temporary license key installed. 3) Verify your license by running  ./lice...
Read more

How to remove or update all data records in Hybris?

Scenario 1: I want to remove all the data from the Hybris ItemType. Solution: If you want to remove all records for particular itemType. Then you can do it using HAC Impex import. Open HAC (/hac) Go to console > ImpEx Import Run the below Impex (Change MyItemType with the ItemType for which you want to remove the data) $targetType=MyItemType REMOVE $targetType[batchmode=true];itemtype(code)[unique=true] ;$targetType Scenario 2: Sometimes, you want to remove selected data based on some condition or probably want to run complex SQL query. Then we wish if we could do it by writing SQL query, as many of developers are aware of syntax and its resources are easily available. Solution: Yes, you can do it in Hybris HAC also. Only thing is you should know the appropriate table and attribute/fields names in DB. If you don't, you can always run the select flexible search query and can see generated SQL query. Open HAC (/hac) Go to console > FlexibleSearch Se...
Read more