SAP Security Patch Day – February 2022
Chapters
Share Article
It seems like a bizarre coincidence that today, February 8th, is not only the second SAP Security Patch Day of the year but it is also Safe Internet Day! SAP is contributing to this by reporting serious security problems in the SAP Web Dispatcher that allow an attacker to attach malicious requests.
SAP fixes a series of HotNews and High vulnerabilities
The vulnerability described in 3123396 (Request smuggling and request concatenation in SAP NetWeaver, SAP Content Server, and SAP Web Dispatcher) requires immediate attention! The flaw gives the attacker the opportunity to impersonate the victim. Since SAP Web Dispatcher and SAP Internet Communication Manager (ICM) in SAP NetWeaver Application Server use the same source code, we strongly recommend that you also patch your systems that have an active instance of SAP ICM.
SecurityBridge customers benefit through updated signatures and tools which allow a quick validation of the Kernel and Web Dispatcher versions across all SAP systems in the landscape.
You can also find more information in the following blog post: How to secure the SAP Internet Communication Manager (SAP ICM)?
A similar vulnerability that “only” received priority High was also patched in SAP NetWeaver Application Server Java published in note 3123427 (HTTP Request Smuggling in SAP NetWeaver Application Server Java).
All SecurityBridge customers have the possibility to continuously check their attack surface. Knowing your attack surface is a critical advantage in the fight against cyberattacks. In this blog post, we explain why: Understand And Reduce The Attack Surface
Log4j also continues to leave its footprint in the February patch release. HotNews fixes for Log4j were published for the SAP Commerce product and also for SAP Data Intelligence 3 (on-premise). If you don’t want to miss any information about Log4j and SAP follow our Log4j – Newsticker.
SAP writes “On 8th of February 2022, SAP Security Patch Day saw the release of 13 new Security Notes. 1 security note was released out-of-band.”. We count 5 additional updates to previously released SAP Security Patches. You can find the full list below.
Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.
Summary by Severity
The February release contains a total of 17 patches for the following severities:
| Severity | Number |
|---|---|
|
Hot News
|
8 |
|
High
|
3 |
|
Medium
|
6 |