HealthCheck Assistance
The Health Check has detected that the version of Solr installed contains a high-priority vulnerability.
A major vulnerability was detected in Apache Java software (CVE-2021-44228) that allows remote code execution and information disclosure if exploited.
A number of files are needed to be upgraded to mitigate this vulnerability. Ensure you are on at least this version of the following files:
Log4j-1.2-api.2.17.1
Log4j-api-2.17.1
Log4j-core-2.17.1
Log4j-slf4j-impl-2.17.1
The new files should replace the versions stored in E:\Search Server\server\lib\ext
Note: If your ENPS Index drive is not the E: drive, you’ll need to change the drive letter as appropriate above. The next release of ENPS 9.0 will include these fixes natively.
Download the software directly from Apache: https://www.apache.org/dyn/closer.lua/logging/log4j/2.17.0/apache-log4j-2.17.1-bin.zip
If you choose to update the Log4j software, do the following:
Open the Services app on your ENPS server.
Stop the SOLRJavaServer service. Note: this will force users to your other ENPS server.
Navigate to: E:\Search Server\server\lib\ext
Back up the following files to another location on your server, where xx is a number lower than 17:
Log4j-1.2-api-2.xx.0.jar
Log4j-api-2.xx.0.jar
Log4j-core-2.xx.0.jar
Log4j-slf4j-impl-2.xx.0
Remove the files in step 4 from the E:\Search Server\server\lib\ext folder in step 3.
Add the 2.17 version of the log4j files above to the E:\Search Server\server\lib\ext folder.
Restart SOLRJavaServer service.
NOTE: If you have any questions, please contact AP ENPS Support before making changes to the HealthCheck configurations.
There are thresholds set within \hc\hc-static_config.ps1. With the default being:
[decimal]$global:HC_Java_Log_Version = 2.17 # Version of Java log components to mitigate Log4J vulnerabilities