We're getting the same questions from customer IT, as news of Log4j spreads. 

Can Sage prepare a KB article we can share about how Sage 100 is (or hopefully isn't) affected by this vulnerability?

We're getting the same questions from customer IT, as news of Log4j spreads. 

Can Sage prepare a KB article we can share about how Sage 100 is (or hopefully isn't) affected by this vulnerability?

Here's the only items I located in the KB:

Agree 100% with Kevin. It would be good at this point to have a KB specific for Sage 100.

Here is an email I received last Saturday (12/11) from ECI (which now owns KnowledgeSync), titled "Important Security Notification"

What Happened:

On December 9, 2021 a security vulnerability in an open source library called Log4J was made public. This library is in wide use within the global software community and is used to log events in the normal use of software, most often in Java- based applications.

If exploited, this vulnerability allows remote code execution on vulnerable servers, giving an attacker the ability to import malware that allows them to take control of targeted systems.

This vulnerability is not unique to ECI’s software and could be present in other software that you use in your business as well. We encourage your internal team to examine the impact of this security issue on other vendor software you may be using.

ECI’s Response:  

Our Security, Cloud Operations, and Product Development teams have worked diligently over the last 24 hours to assess and mitigate our use of Log4j. We have found very few instances of our direct use of Log4j and have remediated these vulnerable versions within our Cloud Offerings.

We continue to monitor the situation and will keep you apprised of any important updates.

How Does this Affect You:

You do not need to take any action at this time.  In most cases, our customers’ use of ECI software products is unlikely to be materially affected by this vulnerability. For ECI customers using our cloud offering, our security team has already identified and applied fixes.

There is no need to contact our support organization. If you are directly affected, we will proactively contact you with further information.​

ECI takes the security of our customers’ software very seriously. We are partners in your success and will continue to communicate any new information as it develops.
 

Thank you,
ECI Support

KB article re: Sage 100: