Apache Log4j Security Alert CVE-2021-44228, CVE-2021-45046 on PeopleSoft Applications (on PeopleTools 8.57 and later releases)
(Doc ID 2828073.1)
Last updated on OCTOBER 27, 2023
Applies to:
PeopleSoft Enterprise PT PeopleTools - Version 8.57 to 8.59 [Release 8.4] Information in this document applies to any platform.
Purpose
This document provides mitigation steps to alleviate the impact associated with CVE-2021-44228 and CVE-2021-45046 on PeopleSoft applications. Refer to Apache Log4j vulnerability described in Oracle Security Alert Advisory CVE-2021-44228 for more details.
Scope
This applies to PeopleSoft Applications on PeopleTools 8.57 and later releases.
PeopleTools Jan 2022 CPU (8.57.24, 8.58.17, 8.59.07) patches already have the mitigations applied.
In PeopleTools patches 8.58.18 and 8.59.08, log4j has been updated to version 2.17.1, which contains fixes for the CVEs addressed in this note.
Prior releases that are not in patch support have not been evaluated.
Important. Monitor this page for updates. Oracle plans to include a mitigation for PeopleSoft applications in an upcoming CPU patch. The plans and timing are not yet finalized.
Details
To view full details, sign in with your My Oracle Support account.
Don't have a My Oracle Support account? Click to get started!
