You're viewing Apigee Edge documentation.
View Apigee X documentation.
On January 13, 2022, we released a new version of Apigee Edge for Private Cloud. The purpose of this release is to address the Apache Log4j2 vulnerability issue. See Security issues fixed.
Updating this release will update the components in the following list of RPMs:
You can check the RPM versions you currently have installed, to see if they need to be updated, by entering:
To update your installation, perform the following procedure on the Edge nodes:
On all Edge nodes:
- Clean the Yum repos:
sudo yum clean all
- Download the latest Edge 4.50.00
curl https://software.apigee.com/bootstrap_4.50.00.sh -o /tmp/bootstrap_4.50.00.sh
- Install the Edge 4.50.00
apigee-serviceutility and dependencies:
sudo bash /tmp/bootstrap_4.50.00.sh apigeeuser=uName apigeepassword=pWord
where uName:pWord are the username and password you received from Apigee. If you omit pWord, you will be prompted to enter it.
- Use the
sourcecommand to execute the apigee-service.sh script:
- Clean the Yum repos:
- Update the
/opt/apigee/apigee-service/bin/apigee-service apigee-machinekey update
- On all Edge nodes, execute the
update.shscript for the edge process:
/opt/apigee/apigee-setup/bin/update.sh -c edge -f configFile
- If you are using Apigee mTLS, follow the procedure described in Upgrade Apigee mTLS. For more information, see Introduction to Apigee mTLS.
Security issues fixed
The following security issue has been fixed in this release.
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
This issue has been fixed. See Bug fixes.
Changes to supported software
There are no changes to supported software in this release.
Deprecations and retirements
There are no new deprecations or retirements in this release.
There are no new features in this release.
This section lists the Private Cloud bugs that were fixed in this release.
The Apache Log4j library shipped with Gateway components' third party libraries has been updated to version 2.17.0
See Known issues with Edge for Private Cloud for a complete list of known issues.