Skip to content

SAP Security Patch Day – December 2021

SAP security Patch day

Today is SAP Security Patch Day! For the last time in 2021, SAP released monthly security updates. Currently, the IT world is in turmoil as earlier this week various information security authorities have drawn attention to a widespread vulnerability called log4j

Log4j - Zero-Day vulnerability for SAP?

From the BSI (link) to the US-CERT (link), authorities issued warnings for log4j, a high severity zero day vulnerability.

SAP customers are worried and are wondering to what extent the critical business applications of SAP SE are affected. The extent of the spread of the vulnerability became clear, even the popular open-source application Apache is affected.

The news about the new vulnerability certainly hit SAP like a bomb. Many customers immediately inquired and SAP is responding promptly. In the meantime, more than 200 Notes (link, requires login) have been published by SAP, many of these notes confirm that specific products are not affected. 

Stay tuned and read regular updates on the Log4j zero day vulnerability - how it can affect your SAP systems, and what you can do to protect your IT infrastructure

SAP did not create all log4j notes in the category “security”. This means that the December release of the SAP Security Patch Day does not list all notes that contain information about the log4j – Zero-Day Vulnerability within SAP products.

The list below shows a few product-specific notes, but SAP may release further notes at any time:
– SAP HANA Advanced Version XS (note 3130698) and
– SAP CC PoS and SAP CC manager – versions 2.0 FP09, 2.0 FP10, 2.0 FP11 PL06 (or lower) and 2.0 FP12 PL04 (or lower) are affected (note 3130499)
– SAP Commerce Platform (All versions) Apache on-premise (note 3130967)
– Database related, Db2 LUW impacted by log4j vulnerability (note 3130882)

Use SecurityBridge Patch Management to never miss an important patch, applicable for your SAP products.

Summary by Severity

The December release contains a total of 15 patches for the following severities:

SeverityNumber
Hot News
5
High
5
Medium
5
NoteDescriptionSeverityCVSS
3130698 [CVE-2021-44228] Remediating log4j CVE-2021-44228 vulnerability in XS Advanced Platform and applications - Product XS Advanced for HANA Platform 2.0 Versions - SPS05, SPS06
Hot News
10
2622660 Update to Security Note released on  Patch Day:Security updates for the browser control Google Chromium delivered with SAP Business ClientProduct – SAP Business Client, Version – 6.5
Hot News
10
3109577 Code Execution vulnerability in SAP Commerce, localization for ChinaRelated CVEs - CVE-2021-21341,CVE-2021-21342,CVE-2021-21349,CVE-2021-21343,CVE-2021-21344,CVE-2021-21346,CVE-2021-21347,CVE-2021-21350,CVE-2021-21351,CVE-2021-21345,CVE-2021-21348
Product - SAP Commerce, localization for China, Version - 2001
Hot News
9.9
3119365 [CVE-2021-44231] Code Injection vulnerability in SAP ABAP Server & ABAP Platform (Translation Tools)
Product - SAP ABAP Server & ABAP Platform (Translation Tools), Versions - 701, 740,750,751,752,753,754,755,756,804
Hot News
9.9
3089831 Update to Security Note released on September 2021 Patch Day:[CVE-2021-38176] SQL Injection vulnerability in SAP NZDT Mapping Table Framework
Product - SAP S/4HANA, Versions - 1511, 1610, 1709, 1809, 1909, 2020, 2021
Product - SAP LT Replication Server, Versions - 2.0, 3.0 
Product - SAP LTRS for S/4HANA, Version - 1.0
Product - SAP Test Data Migration Server, Version - 4.0
Product - SAP Landscape Transformation, Version - 2.0
Hot News
9.9
3114134 [CVE-2021-42064] SQL Injection vulnerability in SAP Commerce
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
High
8.8
3102769 [CVE-2021-42063] Cross-Site Scripting (XSS) vulnerability in SAP Knowledge Warehouse
Product - SAP Knowledge Warehouse, Versions - 7.30, 7.31, 7.40, 7.50
High
8.8
3123196 [CVE-2021-44235] Code Injection vulnerability in utility class for SAP NetWeaver AS ABAP
Product - SAP NetWeaver AS ABAP, Versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756
High
8.4
3124094 [CVE-2021-44232] Directory Traversal vulnerability in SAF-T Framework
Product - SAF-T Framework, Versions - SAP_FIN 617, 618, 720, 730, SAP_APPL 600, 602, 603, 604, 605, 606, S4CORE 102, 103, 104, 105
High
7.7
3113593 Denial of service (DOS) in SAP CommerceRelated CVE - CVE-2021-37714
Product - SAP Commerce, Versions - 1905, 2005, 2105, 2011
High
7.5
3101299 [CVE-2021-42066] Information Disclosure vulnerability in SAP Business One
Product - SAP Business One, Version - 10
Medium
6.6
3000663 Update to Security Note released on July 2021 Patch Day:[CVE-2021-33683] HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager
Product - SAP Web Dispatcher and Internet Communication Manager, Versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83
Medium
5.4
3121165 [Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise ViewerCVEs - CVE-2021-42068,CVE-2021-42070, CVE-2021-42069, CVE-2021-42069
Product - SAP 3D Visual Enterprise Viewer, Version - 9
Medium
4.3
2843016 Update to Security Note released on November 2019 Patch Day:[CVE-2019-0388] Content spoofing vulnerability in UI5 HTTP Handler
Product - SAP UI, Versions - 7.5, 7.51, 7.52, 7.53, 7.54
Product - SAP UI 700, Versions - 2.0
Medium
4.3
3103677 [CVE-2021-42061] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (Web Intelligence)
Product - SAP BusinessObjects Business Intelligence Platform, Version - 420
Medium
4.1
3080816 [CVE-2021-44233] Missing Authorization check in GRC Access Control
Product - SAP GRC Access Control, Versions - V1100_700, V1100_731, V1200_750
Low
2.4

Source

Posted by

Christoph Nagy
Find recent Security Advisories for SAP©
Download the White Paper “YOUR ROAD TO SAP SECURITY” to learn about the major milestones towards increasing the cybersecurity posture of your SAP systems.

Webinar: Why is SAP Security Patching not like Windows Updates?

The webinar, taking place on demand is all about SAP Patch Management and its challenges. The German-speaking SAP User Group (DSAG) and the American colleagues of ASUG asked why SAP security patching cannot be as simple and effective as, for example, Windows updates.
SAP Security Services
SAP Cybersecurity- Security News
Many companies have recognized the need for SAP cybersecurity, but many have also realized that they cannot accomplish this alone. There are many reasons for this. It can be due to the internal teams' workload or due to the employee's level of knowledge. However, there is a solution that neither burdens your internal staff nor demands additional knowledge. A specialized managed SAP Security Service allows you to harden mission-critical systems, detect and promptly counteract non-compliance, and implement monitoring with accurate anomaly detection.
Patch Management
SAP security provider SecurityBridge—now operating in the U.S.—today announced the full integration of its SAP Security Platform with the Microsoft Sentinel cloud-native Security Information and Event Manager (SIEM) platform and its membership to MISA. SecurityBridge was nominated to MISA because of the integration of its SAP Controller to the Microsoft Sentinel dashboard. SecurityBridge is a Smart Data Adapter that significantly simplifies security monitoring of critical and highly specific business applications.
Angriffserkennung für SAP
SAP Cybersecurity- SAP Identity and Authorization- SAP Threat Monitoring- Security News
Viele unserer Leserinnen und Leser erinnern sich noch an den 25. Mai 2018, Stichtag der bindenden Einführung der Datenschutzgrundverordnung, kurz DSGVO. Verstöße gegen die neue Regelung können seitdem zu drakonischen Strafen führen. Nun steht, zumindest für diejenigen Unternehmen, die zur kritischen Infrastruktur (KRITIS) von Deutschland zählen, ein ähnlicher Termin ins Haus. Am 1. Mai 2023 müssen betroffene Unternehmen ein System zur Angriffserkennung eingeführt haben.
SAP Cybersecurity Risks
SAP Cybersecurity- SAP Security Framework- Security News
Recently, we gave an insight into the known SAP attackers in our blog. Of course, it can already be deduced from this that there are internal and external SAP attackers. That is why today, we want to look at this from an SAP cybersecurity risk perspective.