The Apache Log4j Library contain a set of security vulnerabilityies

CVE-2021-45105, CVE-2021-44228.

Vector Embedded Products

Vector embedded software products for ECUs (e.g., MICROSAR) do not employ the Apache Log4j Library. Concerning the security of the embedded software, any exploit of this vulnerability is therefore equivalent to any other vulnerability at infrastructure level.

Vector Embedded Products related Tool Products & Tools

Vector provides Java-based development tools and helper tools used for the configuration/analysis of the embedded software. Package Manager uses Apache Log4j. Affected Product Versions are shown below. All newer Product Versions (as the latest stated Product Version) will not contain any version of Log4j affected by CVE-2021-45105 or CVE-2021-44228.

Please check the Apache Website for the latest information on workarounds and/or mitigations:

See also https://logging.apache.org/log4j/2.x/security.html.

We assume that there is no significant increase of risk resulting from the usage of this tool since it is a client-only tool establishing an authenticated communication to the Vector Portal.

Only the Package Manager Versions below are affected by this vulnerability. This issue will be fixed in future Service Packs, Updates or is already fixed via hotfix (Fix Version). After availability of Fix Version, you will be notified in Package Manager.

Please update to one of the Fix Version mentioned in the description below when its available.

Please replace all copies and installations of the affected Version on your side.

for CVE-2021-44228

V1.33.0 V1.33.1 (affected)

• A hotfix (v1.33.2) is planned for 01/2022
• We recommend updating to new Version v1.33.2 or later Versions after availability

for CVE-2021-45105

V1.33.0 (affected)

• A hotfix (v1.33.1) is planned till Wednesday, 22th of December 2021
• We recommend updating to new Version v1.33.1 or later Versions after availability

for CVE-2021-44228 & CVE-2021-45105

all Versions < v1.33.0 (affected)

• We recommend updating to new Version v1.33.1 or later Versions after availability (see v1.33.0)