Patches and updates

ArcGIS Server Log4j Patch

Published: February 4, 2022

Summary

This security patch addresses multiple security vulnerabilities found in log4j distributed with ArcGIS Server. Esri recommends that all customers using ArcGIS Server 10.6 apply this patch.

Description

Esri® announces the ArcGIS Server Log4j Patch. Esri recommends that all customers using ArcGIS Server 10.6 apply this patch. This patch deals specifically with the issue listed below under Issues Addressed with this patch.

Issues Addressed with this patch

To avoid conflicts on 10.6 this patch also addresses:
  • BUG-000128060 - ArcGIS Server has a Server Side Request Forgery (SSRF) security vulnerability.
  • BUG-000121862 - ArcGIS Server becomes unresponsive and consumes more than 90 percentage of cpu when there are a large number(many thousands) of Hosted services running in 10.6.0. fails.
  • BUG-000113291 - There is an improper access control issue in ArcGIS Server.
  • BUG-000112254 - Donut polygons are represented with polygons instead of 'holes' in Web Feature Service (WFS) services in ArcGIS Server 10.5.1.
  • BUG-000112146 - WFS GetFeature request with a BBOX Filter and two layers does not work.
  • BUG-000111713 - addToDefnition should allow adding layers that do not include WKID or SDESRID.
  • BUG-000111711 - Spatial Analysis tools should work with data in WKT-only spatial reference.
  • BUG-000111446 - WFS-T services can only be altered with a transaction with POST using WFS 2.0.0 syntax, even when forcing the version in the request to 1.1.0.
  • BUG-000111075 - A feature service consumed in a GeoEvent Service fails to re-establish communication with the database once the database connection comes back after a communication failure.
  • BUG-000110938 - EsriFieldTypeSingle behaves as an INT in WFS service published to ArcGIS Server 10.5.1.
  • BUG-000110388 - The ObjectID and GlobalID fields are not exposed in Web Feature Service (WFS) services in ArcGIS server 10.5.x.
  • BUG-000109738 - A Web Feature Service (WFS) displays a zero instead of a null value for the field attributes when queried through a browser.
  • BUG-000109619 - WFS fails to yield data using DescribeFeatureType when accented characters (i.e. A) are used in layer Names.
  • BUG-000109441 - The GetFeature service shows "Shape xsi:nil="true"" for a Web Feature Service (WFS) when the service has fields in the properties tab under "Table of Content" as invisible.
  • BUG-000102408 - WFS-T Inserts indicate success yet there's no point added.
  • NIM100766 - The date filter does not work with the Web Feature Service (WFS) GetFeature capability.

Installing this patch on Windows

Installation Steps:

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

  1. Download the appropriate file to a location other than your ArcGIS installation location.

    ArcGIS 10.6  
       
    ArcGIS Server ArcGIS-106-S-Log4j-Patch.msp
         Checksum
         (SHA256)    		 B2DBF7F8F591C532D369D6E5F7C5035A3953685E3D0658C775326D46BEDB8149
       

  2. Make sure you have write access to your ArcGIS installation location.
  3. Double-click ArcGIS-106-S-Log4j-Patch.msp to start the setup process.

    NOTE: If double clicking on the MSP file does not start the setup installation, you can start the setup installation manually by using the following command:

    msiexec.exe /p [location of Patch]\ArcGIS-106-S-Log4j-Patch.msp

Installing this patch on Linux

Installation Steps:

Complete the following install steps as the ArcGIS Install owner. The Install owner is the owner of the arcgis folder.

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

  1. Download the appropriate file to a location other than your ArcGIS installation location.


    ArcGIS Enterprise 10.6  
       
    ArcGIS Server ArcGIS-106-S-Log4j-Patch-linux.tar
         Checksum
         (SHA256)    		 6624CFA8A1F55AF1B95CAC9E6EA9E76542D6EA63E936384BEF4563A0A3F30660
       

  2. Make sure you have write access to your ArcGIS installation location, and that no one is using ArcGIS.
  3. Extract the specified tar file by typing:

    % tar -xvf ArcGIS-106-S-Log4j-Patch-linux.tar
     
  4. Start the installation by typing:

    % ./applypatch

    This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

Upgrade a geodatabase

When a hotfix or patch for ArcGIS has been applied, it may also be necessary to upgrade your geodatabase. See the Upgrade the Geodatabase section on the Geodatabase management page for your individual DBMS platform for more information.

Uninstalling this patch on Windows

  • To uninstall this patch on Windows, open the Windows Control Panel and navigate to installed programs. Make sure that "View installed updates" (upper left side of the Programs and Features dialog) is active. Select the patch name from the programs list and click Uninstall to remove the patch.

Uninstalling this patch on Linux

  • To remove this patch on versions 10.6 and higher, navigate to the <Product Installation Directory>/.Setup/qfe directory and run the following script as the ArcGIS Install owner:

    ./removepatch.sh

    The removepatch.sh script allows you to uninstall previously installed patches or hot fixes. Use the -s status flag to get the list of installed patches or hot fixes ordered by date. Use the -q flag to remove patches or hot fixes in reverse chronological order by date they were installed. Type removepatch -h for usage help.

  • Restart your ArcGIS services

Patch Updates

Check the Patches and Service Packs page periodically for the availability of additional patches. New information about this patch will be posted here.

How to identify which ArcGIS products are installed

To determine which ArcGIS products are installed, choose the appropriate version of the PatchFinder utility for your environment and run it from your local machine. PatchFinder will list all products, hot fixes, and patches installed on your local machine.

Getting Help

Domestic sites, please contact Esri Technical Support at 1-888-377-4575, if you have any difficulty installing this patch. International sites, please contact your local Esri software distributor.


Download ID:7977

Get help from ArcGIS experts

Contact technical support

Download the Esri Support App

Go to download options