Hello,

Per SAP 

"SAP BusinessObjects BI Platform is not impacted by CVE-2021-44228, CVE-2021- 45046 & CVE-2021-45105, CVE-2021-44832".

Crystal Reports is an optional install with Sage 100, the install is not required to access or use Sage 100.

Per SAP removing Apache log4j components will cause a re-install of Crystal Reports. (this has not been verified).  Awaiting an answer from the Fixed Assets team.

John Nichols

Sage

Thank you for the information. SAP is ignoring the fact that Log4j version 1 reached end of life on August 2015 and is no longer getting patched, they are still using it with Crystal Reports 2016. Log4j version 1 is plagued by the following vulnerabilities: CVE-2019-17571, CVE-2020-9488, CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307. I will check and see if our client is utilizing Crystal Reports for Sage 100. Thank you for checking Fixed Assets. They are also using HRMS and the client states the following "I also use a SAGE HRMS for my payroll functions that I have custom crystal reports in".

Thank you for the information. SAP is ignoring the fact that Log4j version 1 reached end of life on August 2015 and is no longer getting patched, they are still using it with Crystal Reports 2016. Log4j version 1 is plagued by the following vulnerabilities: CVE-2019-17571, CVE-2020-9488, CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307. I will check and see if our client is utilizing Crystal Reports for Sage 100. Thank you for checking Fixed Assets. They are also using HRMS and the client states the following "I also use a SAGE HRMS for my payroll functions that I have custom crystal reports in".

Hi, There is a Crystal Reports 2020 version available for Sage 100 and Sage Fixed Assets.

Good Morning, just wondering if you found out whether or not Crystal Reports 2020 is using Apache Log4j? I tried reaching out myself but we do not have a support contract with SAP.