<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Oregon GIS Community,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For those of you who use Esri software products, Esri had reached out this morning with news about updates to their blog article on the Log4j Critical Vulnerability. Please see their blog article below and recommended steps. If you have
questions, please contact Esri tech support directly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-software-and-cve-2021-44228-aka-log4shell-aka-logjam/">https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-software-and-cve-2021-44228-aka-log4shell-aka-logjam/</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">They wanted to highlight specifically the scripts they have created to remove the JndiLookup Class:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">“Out of an abundance of caution, Esri has created Log4Shell mitigation scripts that are strongly recommended to be applied to all installations of ArcGIS Enterprise and ArcGIS Server of any version of the software. The scripts remove the
JndiLookup class which is the only <a href="https://logging.apache.org/log4j/2.x/security.html" target="_blank">mitigation measure recommended by Apache Log4j</a> that does not require updating the Log4j version. This action fully addresses CVE-2021-44228
and CVE-2021-45046. The scripts have been validated for versions 10.6 and above, however they should work on older versions of ArcGIS Enterprise and ArcGIS Server as well. Separate detailed instructions and scripts are available for:<o:p></o:p></p>
<p class="MsoNormal"><a href="https://support.esri.com/Technical-Article/000026951" target="_blank">ArcGIS Server</a> – Also includes mitigation for ArcGIS GeoEvent Server<o:p></o:p></p>
<p class="MsoNormal"><a href="https://support.esri.com/Technical-Article/000026950" target="_blank">Portal for ArcGIS</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://support.esri.com/Technical-Article/000026949" target="_blank">ArcGIS Data Store</a>”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="702" style="width:526.5pt;border-collapse:collapse">
<tbody>
<tr style="height:62.3pt">
<td width="116" valign="top" style="width:87.35pt;padding:0in 4.6pt 0in 4.6pt;height:62.3pt">
<p class="MsoNormal" style="line-height:105%"><img border="0" width="121" height="87" style="width:1.2583in;height:.9041in" id="Picture_x0020_1" src="cid:image001.png@01D7F19F.5A6D8520"><o:p></o:p></p>
</td>
<td width="487" valign="top" style="width:365.4pt;padding:0in 4.6pt 0in 4.6pt;height:62.3pt">
<p class="MsoNormal" style="line-height:105%"><b>David Mather, GISP<o:p></o:p></b></p>
<p class="MsoNormal" style="line-height:105%">Geospatial Data Admin / Sys Admin<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%">Enterprise Information Services<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%">Data Governance and Transparency | GEO<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%">Cell:971.900.9643 Desk:503.378.2166 | gis.oregon.gov<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>