Skip to main content

Apache Log4j Vulnerability and MagicINFO

Legacy article

This article is historical. It applies only to MagicINFO Server versions up to V20.1020.0; later releases already include the updated libraries. It is kept for reference for installations still running affected versions.

Impact assessment​

The critical Log4j vulnerability (CVE-2021-44228, "Log4Shell") was found in the log4j-core package. MagicINFO Server does not use log4j-core, so the exploit itself does not apply to a MagicINFO installation.

However, traces of other Log4j 2.x components — log4j-api and log4j-slf4j — were found on the server. As a precaution, Samsung released a hotfix that brings Log4j up to version 2.17.1. Applying it is recommended for any installation on an affected version.

Applying the server hotfix​

The hotfix consists of a replacement KpiClient.war file. It was distributed by Samsung; contact your Samsung representative to obtain it.

  1. Stop the MagicINFO services in Windows.
  2. Extract KpiClient.war from the hotfix archive and replace the existing file at [MAGICINFO_INSTALL]/runtime/kpiclient/KpiClient.war.
  3. Delete the folder [MAGICINFO_INSTALL]/tomcat/webapps/kpi.
  4. Start the MagicINFO services again.

Web Author and Layout Editor​

Samsung also recommended updating the companion tools to hotfix builds that include logback 1.2.9:

  • Web Author 20.1020.2
  • Layout Editor 21.1010.5

These hotfix packages were likewise distributed by Samsung — contact your Samsung representative to obtain them. Each package includes a readme file describing how to apply the update.

Last updated on