SugarCRM Information Regarding Log4j Vulnerability

RE: SugarCRM Information Regarding Log4j Vulnerability

Nathan Romine — Thu, 20 Jan 2022 17:45:53 GMT

Several software components inside of the SugarCRM cloud platform were vulnerable to the log4j vulnerability, however, no client or public facing systems were vulnerable. To be clear, the SugarCRM platform did NOT have any publicly facing infrastructure that was vulnerable, and immediate and continuous monitoring of the environment has shown no attempts or compromises of previously vulnerable software components.

All known configurations, patches, and remediations were in place by December 13th, and all continuously released log4j patches or remediations are tested and put in place as they become available from 3rd parties.

RE: SugarCRM Information Regarding Log4j Vulnerability

Saad Azad — Thu, 30 Dec 2021 08:13:02 GMT

Hi Nathan,

There are further Apache Log4j Vulnerability tracked as (CVE-2021-44832) and the patches released earlier were found to be insufficient. Do you have any update on the same?

Thanks

RE: SugarCRM Information Regarding Log4j Vulnerability

Manish kumar — Thu, 23 Dec 2021 05:23:13 GMT

He Team,

We are Using SugarCRM 9.XX EP is this worried for Us ? Or any update or action required ?

RE: SugarCRM Information Regarding Log4j Vulnerability

Ken McCartney — Fri, 17 Dec 2021 19:27:12 GMT

According to documentation on supported platforms, version 11 of sugarcrm only supports elasticsearch version 7.9 https://support.sugarcrm.com/Resources/Supported_Platforms/.

Will sugarcrm v11 function with elasticsearch v7.16.1 ?

Thanks.