Bruker patches for Log4j CVE-2021-44228 issue

受影响的版本

• TopSpin 3.5
• Topspin 3.6
  
• TopSpin 4

Older versions of TopSpin use the Log4j 1.x version of the library, which is not affected.

How to apply the patch
力量的当前版本补丁是艾娃ilable here:

The patch automatically identifies product installations on your system and provides a graphical user interface for information.

Windows
补丁作为可执行文件交付。下载后，只需双击文件即可启动补丁。它会自动要求执行管理特权。

Linux
补丁作为可执行文件交付。After download, open a shell, ensure you have administration privileges on your machine, then execute the .sh file.

macOS
The patch is delivered as disk image. After download, double-click the .dmg file to mount it, then execute the installer file shown. You may need to go “System Preferences / Security & Privacy” and approve the execution of the installer.

Please find a change log and more information here:

The TopSpin Log4j Patcher will fix existing TopSpin and GoScan installations that may use affected Log4j 2 versions. Details about the vulnerability are available here:https://nvd.nist.gov/vuln/detail/CVE-2021-44228

该工具将从安装中删除Jndilookup类。这是官方Apache Log4J网站上描述的建议缓解策略：https://logging.apache.org/log4j/2.x/security.html#

Please note that the patch executable cannot be used on the CentOS 5 operating system (which is end of life since March 2017).

受影响的版本

• Goscan 3

The patch for TopSpin installations can be used for GoScan installations as well. Please follow the instructions given for TopSpin above. The patch automatically identifies product installations on your system and provides a graphical user interface for information.

Note: For any GoScan version earlier than 3.0, please upgrade to the latest GoScan version first, then apply the patch.

Please download and run this patch even if you have applied earlier versions of the patch. Version 1.0.8 also removes backup copies of the affected file which are uncritical for your system but may still cause warnings by vulnerability scanners.

The GoScan Log4j Patcher (install4j-goscan-log4j2-patch) will fix existing GoScan installations that may use affected Log4j 2 versions. Details about the vulnerability are available here:https://nvd.nist.gov/vuln/detail/CVE-2021-44228

该工具将从安装中删除Jndilookup类。这是官方Apache Log4J网站上描述的建议缓解策略：https://logging.apache.org/log4j/2.x/security.html#

Version 1.0.1 or later of the patch now handles the file bsmsserver.jar accordingly. This file was uncritical but could be detected by common scanning tools.