log4shell patch

support.quest.com/.../apache-log4j-2-cve-2021-44228-vulnerability

Is there a manual fix (editing jar files) like other vendors are providing, for a customer with perpetual licenses but which chose not to renew the support license less than a month ago?  We are running 13.5.0.2119.

We removed and renamed Log4J 2.17 back to the version.  Appears to work correctly until we can get a patch for Spotlight.

We have found log4j jar-files with version 2.13 on our Diagnostic Servers.

They are running Spotlight 13.3, but it looks like the latest Spotlight version (13.5) was release before log4j was patched to 2.15.

When do we have a Spotlight version where log4j is patched to mitigate log4shell.

https://reliablepermitsolutions.com/

Hi NielsGrove,

Good Afternoon,

This issue has been fixed on Spotlight on SQL Server version 13.6.

https://support.quest.com/spotlight-on-sql-server-enterprise/13.6/download-new-releases

Thank you,

Edgar