log4j patch Update

[Suresh.H]

Wanted to confirm on a couple of things as there has been changes in the recent past on these. 

1. Saw a change in assessment for 2.17 applicability in the web site. Earlier it was mentioned that machine agent was vulnerable and that has been updated as below (that machine agent is not vulnerable). We are presuming that this is the final assessment and going ahead with this in mind.

1. Earlier we noticed that build 21.12.4 was published on 17-Dec and we saw an updated build on 20-Dec. We are packaging this build (on 20-Dec) along with our binaries.

Please confirm that this is the final official build for 21.12.4 and we will get official support in case of any issues ?

Also, if there are changes to the build, can those be published with newer version numbers as it becomes easy to understand and manage. Having same version with build date change is confusing and cause issues based on when we pick the build.

[Michelle.Koblas]

Yes, your analysis and understanding are correct.  For the Machine Agent, we determined that it is not vulnerable to CVE-2021-45105.  Recognizing that many of the security scanners used by our customers will not be able to make this distinction and will flag the product as vulnerable just due to the library version, our team has taken proactive measures to upgrade the log4j version used, which is why there is a 21.12.4 version of the Machine Agent.