Skip to main content

Patches and updates

ArcGIS Notebook Server Security Patch

Published: March 28, 2022

Summary

This security patch addresses multiple security vulnerabilities found in log4j distributed with ArcGIS Notebook Server. Esri recommends that all customers using ArcGIS Notebook Server 10.8.1 with advanced license and advanced notebook runtime apply this patch.

Description

EsriĀ® announces the ArcGIS Notebook Server Security Patch. Esri recommends that all customers using ArcGIS Notebook Server 10.8.1 with advanced license and advanced notebook runtime apply this patch. This patch is not required if your notebook server is configured with a standard license and only a standard notebook runtime.

This patch deals specifically with the issues listed below under Issues Addressed with this patch.

Issues Addressed with this patch

To avoid conflicts this patch also addresses:

  • BUG-000139408 - There is a denial-of-service security vulnerability in ArcGIS Notebook Server.

Installing this patch on Windows

Installation Steps:

This patch should be installed on all ArcGIS Notebook Server installations related to the ArcGIS Notebook Server site.

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

  1. Download the appropriate file to a location other than your ArcGIS installation location.

    ArcGIS Enterprise 10.8.1  
       
        ArcGIS Notebook Server ArcGIS-1081-NBS-Log4j-Patch.msp
         Checksum
         (SHA256)
    F34F513B31C0DDC90BE26EEF128011234452BA54E066BA62DAE74B02576760B7
       
  2. Make sure you have write access to your ArcGIS installation location.
  3. Double-click ArcGIS-1081-NBS-Log4j-Patch.msp to start the setup process.

    NOTE: If double clicking on the MSP file does not start the setup installation, you can start the setup installation manually by using the following command:

    msiexec.exe /p [location of Patch]\ArcGIS-1081-Log4j-Patch.msp

Post installation steps for installing the Advanced Notebook Runtime Image on Windows.

Complete the following steps to download and install the advanced runtime image included with this patch.

  1. Download the advanced runtime image file to a location other than your ArcGIS installation location.
    ArcGIS Enterprise 10.8.1  
       
        ArcGIS Notebook Server Advanced arcgis-notebook-python-advanced-10.8.1.14362.1.tar.gz
         Checksum
         (SHA256)
    C319A5CD81EBC89AE1EE34BD591E9A167AB18AE6853B20CA73B594427554B330
       

  2. Open the command prompt window as an administrator.
  3. Change directories to the ArcGIS Notebook Server tools folder. By default,this path is C:\Program Files\ArcGIS\NotebookServer\tools\postInstallUtility.
  4. Optionally, refer to the utility's help by running the following command:

    > PostInstallUtility.bat -h
  5. Install the Docker image arcgis-notebook-python-advanced-10.8.1.28388.1.tar.gz by specifying its file path. The image should be zipped in the .tar.gz format. Run the following command:

    > PostInstallUtility.bat -l arcgis-notebook-python-advanced-10.8.1.14362.1.tar.gz
  6. Run the following command to update the imageId in the advanced runtime:

    > PostInstallUtility.bat -r 4.0 true false
  7. Open ArcGIS Notebook Server Manager and sign in using an administrator account.

    https://arcgisportal.domain.com/<webadaptor>/home/notebook/manager.html
  8. Browse to Settings -> Runtimes
  9. Edit ArcGIS Notebook Python 3 Advanced Version 4.0 runtime. Review and adjust the default properties as needed.

Installing this patch on Linux

Installation Steps:

Complete the following install steps as the ArcGIS Install owner. The Install owner is the owner of the arcgis folder. This patch should be installed on all ArcGIS Notebook Server installations related to the ArcGIS Notebook Server site.

The ArcGIS product listed in the table must be installed on your system before you can install a patch. Each patch setup is specific to the ArcGIS product in the list. To determine which products are installed on your system, please see the How to identify which ArcGIS products are installed section. Esri recommends that you install the patch for each product that is on your system.

  1. Download the appropriate file to a location other than your ArcGIS installation location.

    ArcGIS Enterprise 10.8.1  
       
        ArcGIS Notebook Server ArcGIS-1081-NBS-Log4j-Patch-linux.tar
         Checksum
         (SHA256)
    2F512BBFC73323C08DB322712496CB11BED452D3EE87016E7F7AB3B9E64645B0
       

  2. Make sure you have write access to your ArcGIS installation location, and that no one is using ArcGIS.
  3. Extract the specified tar file by typing:

    % tar -xvf ArcGIS-1081-NBS-Log4j-Patch-linux.tar
  4. Start the installation by typing:

    % ./applypatch

    This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

Post installation steps for installing the Advanced Notebook Runtime Image on linux.

Complete the following steps to download and install the advanced runtime image included with this patch.

  1. Download the advanced runtime image file to a location other than your ArcGIS installation location.

    ArcGIS Enterprise 10.8.1  
       
        ArcGIS Notebook Server Advanced arcgis-notebook-python-advanced-10.8.1.14362.1.tar.gz
         Checksum
         (SHA256)
    C319A5CD81EBC89AE1EE34BD591E9A167AB18AE6853B20CA73B594427554B330
       

  2. Open a terminal using the ArcGIS Notebook Server installation account.
  3. Change directories to the ArcGIS Notebook Server tools folder. By default, this path is ${HOME}/arcgis/notebookserver/tools/postInstallUtility.
  4. Optionally, refer to the utility's help by running the following command:

    > ./PostInstallUtility.sh -h
  5. Install the Docker image arcgis-notebook-python-advanced-10.8.1.14362.1.tar.gz by specifying its file path. The image should be zipped in the .tar.gz format. Run the following command:

    > ./PostInstallUtility.sh -l arcgis-notebook-python-advanced-10.8.1.14362.1.tar.gz
  6. Run the following command to update the imageId in the advanced runtime:

    > PostInstallUtility.sh -r 4.0 true false
  7. Open ArcGIS Notebook Server Manager and sign in using an administrator account.

    https://arcgisportal.domain.com/<webadaptor>/home/notebook/manager.html
  8. Browse to Settings -> Runtimes
  9. Edit ArcGIS Notebook Python 3 Advanced Version 4.0 runtime. Review and adjust the default properties as needed.

Uninstalling this patch on Windows

  1. To uninstall this patch on Windows, open the Windows Control Panel and navigate to installed programs. Make sure that "View installed updates" (upper left side of the Programs and Features dialog) is active. Select the patch name from the programs list and click Uninstall to remove the patch.
  2. Open ArcGIS Notebook Server Administrator Directory.

    https://notebookserver.domain.com:11443/arcgis/admin

  3. Sign in using an administrative user account.
  4. Browse to Restore Factory Runtimes.

    https://notebookserver.domain.com:11443/arcgis/admin/notebooks/runtimes/restore

  5. Click Restore Factory Runtime to update imageId in notebook runtime.

Uninstalling this patch on Linux

ArcGIS Notebook Server Security Patch for Linux should not be uninstalled. The uninstall is not disabled, but it is recommended that you completely uninstall the product and then re-install if it becomes necessary.

  1. To remove this patch on versions 10.7 and higher, navigate to the <Product Installation Directory>/.Setup/qfe directory and run the following script as the ArcGIS Install owner:

    ./removepatch.sh

    The removepatch.sh script allows you to uninstall previously installed patches or hot fixes. Use the -s status flag to get the list of installed patches or hot fixes ordered by date. Use the -q flag to remove patches or hot fixes in reverse chronological order by date they were installed. Type removepatch -h for usage help.

  2. Restart your ArcGIS services.
  3. Open ArcGIS Notebook Server Administrator Directory.

    https://notebookserver.domain.com:11443/arcgis/admin

  4. Sign in using an administrative user account.
  5. Browse to Restore Factory Runtimes.

    https://notebookserver.domain.com:11443/arcgis/admin/notebooks/runtimes/restore

  6. Click Restore Factory Runtime to update imageId in notebook runtime.

Patch Updates

Check the Patches and Service Packs page periodically for the availability of additional patches. New information about this patch will be posted here.

How to identify which ArcGIS products are installed

To determine which ArcGIS products are installed, choose the appropriate version of the PatchFinder utility for your environment and run it from your local machine. PatchFinder will list all products, hot fixes, and patches installed on your local machine.

Getting Help

Domestic sites, please contact Esri Technical Support at 1-888-377-4575, if you have any difficulty installing this patch. International sites, please contact your local Esri software distributor.



Download ID:8009

Get help from ArcGIS experts

Contact technical support

Download the Esri Support App

Go to download options