MicroStrategy’s response to the Log4j Vulnerability (CVE-2021-44228) and (CVE-2021-45046)

Updated: January 7 2022
Strategy 2021 Update 4.1 and 2020 Update 6 are now available and provide a comprehensive fix for the Apache Log4j library vulnerabilities.  Download it today from the MicroStrategy Resource Center or access Strategy on AWS or Azure via the MicroStrategy Cloud Console - including one-click upgrade ready to go!  We strongly recommend all customers not already on 2021 Update 4 apply Strategy 2021 Update 4.1.  Those who cannot make the jump to 2021 should upgrade to 2020 Update 6.
Strategy has been tracking a remote code execution vulnerability (CVE-2021-44228) known as “Log4Shell” and (CVE-2021-45046, CVE-2021-45105, CVE-2021-44832) which affects the Java logging library Apache Log4j.  The Log4J library is widely used in many applications and services across the industry and this vulnerability and mitigations have been widely reported on, including:

• https://logging.apache.org/log4j/2.x/security.html
• https://www.cve.org/CVERecord?id=CVE-2021-44228
• https://www.cve.org/CVERecord?id=CVE-2021-45046
• https://www.randori.com/blog/cve-2021-44228/
• http://www.openwall.com/lists/oss-security/2021/12/14/4

In the following article we are providing information with recommended actions to help maintain the security posture of your Strategy environment.  Please ensure that you are logged into our Strategy Community to see this article:
MicroStrategy’s response to the Log4j Vulnerability (CVE-2021-44228) and (CVE-2021-45046)