topic Re: How to handle log4j flagged in ArcGIS Portal and Pro directory? in ArcGIS Enterprise Questions

How to handle log4j flagged in ArcGIS Portal and Pro directory?

Yogesh_Chavan — Thu, 24 Oct 2024 05:46:47 GMT

Hello,

Can someone confirm if the below flagged directories with log4j be considered unsafe? We are using ArcGIS Enterprise 11.3 and these components were flagged on the ArcGIS Portal machine.

Directory of C:\Program Files\ArcGIS\Portal\framework\runtime\ds\framework\lib log4j-1.2-api.jar Directory of C:\Program Files\ArcGIS\Portal\framework\runtime\ds\framework\runtime\opensearch\plugins\repository-gcs log4j-1.2-api-2.20.0.jar Directory of C:\Program Files\ArcGIS\Portal\framework\runtime\ds\framework\runtime\opensearch\plugins\repository-s3 log4j-1.2-api-2.20.0.jar Directory of C:\Program Files\ArcGIS\Portal\framework\runtime\tomcat\lib log4j-1.2-api-2.22.1.jar Directory of C:\Program Files\ArcGIS\Pro\bin\Python\envs\arcgispro-py3\Lib\site-packages\saspy\java\iomclient log4j-1.2-api-2.19.0.jar Directory of C:\Program Files\ArcGIS\Pro\java\runtime\spark\jars log4j-1.2-api-2.20.0.jar

Re: How to handle log4j flagged in ArcGIS Portal and Pro directory?

ChrisUnderwood — Thu, 24 Oct 2024 08:09:35 GMT

Hello @Yogesh_Chavan , you don't mention what security scanner you used to generate this list. False positives can be a problem with many scanners. Check whether you are using one of the scanners listed in the Security Scanner False Positives section below.

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-software-and-cve-2021-44228-aka-log4shell-aka-logjam/

Re: How to handle log4j flagged in ArcGIS Portal and Pro directory?

Yogesh_Chavan — Thu, 24 Oct 2024 13:34:30 GMT

Thank you for the details @ChrisUnderwood, I can check these details with the IT team.