You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs). info

On January, 13, 2022, we released a new version of Apigee Edge for Private Cloud.
The purpose of this release is to address the
[Apache
Log4j2 vulnerability](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) issue. See [Security issues fixed](https://docs.apigee.com/release/notes/4510003-private-cloud-relnotes#securityissuesfixed).

> [!NOTE]
> **Note about the Apache Log4j vulnerability:**
>
> <br />
>
> Edge for Private Cloud's default configuration contains Log4j 2 but
> is not vulnerable to Log4j 2
> ([CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228)).
>
> Likewise, Edge for Private Cloud is not affected by the
> related vulnerability in Apache Log4j-1.x, which is shipped with ZooKeeper. That
> vulnerability requires a
> specific configuration of Log4j-1.x that Edge for Private Cloud
> does not ship as a default configuration. Therefore the vulnerability is not
> exploitable in Edge for Private Cloud.

> [!NOTE]
> For more information, see the following resources:
>
> - *[Edge for Private Cloud 4.51.00
>   documentation](https://docs.apigee.com/private-cloud/v4.51.00)*
> - *Questions or issues?* Contact [Apigee Edge Support](https://docs.apigee.com/api-platform/troubleshoot/support)
> - *Release notifications* : See [Get Apigee Edge release notifications](https://docs.apigee.com/release/get-release-notifications)

## Update procedure

Updating this release will update the components in the following list of RPMs:

- edge-gateway-4.51.00-0.0.60151.noarch.rpm
- edge-management-server-4.51.00-0.0.60151.noarch.rpm
- edge-message-processor-4.51.00-0.0.60151.noarch.rpm
- edge-postgres-server-4.51.00-0.0.60151.noarch.rpm
- edge-qpid-server-4.51.00-0.0.60151.noarch.rpm
- edge-router-4.51.00-0.0.60151.noarch.rpm
- edge-analytics-4.51.00-0.0.40054.noarch.rpm
- apigee-machinekey-1.1.2-0.0.20018.noarch.rpm

You can check the RPM versions you currently have installed, to see if they
need to be updated, by entering:

```
apigee-all version
```

To update your installation, perform the following procedure on the Edge nodes:

1. On all Edge nodes:

   1. Clean the Yum repos:

      ```
      sudo yum clean all
      ```
   2. Download the latest Edge 4.51.00 `bootstrap_4.51.00.sh` file to `/tmp/bootstrap_4.51.00.sh`:

      ```
      curl https://software.apigee.com/bootstrap_4.51.00.sh -o /tmp/bootstrap_4.51.00.sh
      ```
   3. Install the Edge 4.51.00 `apigee-service` utility and dependencies:

      ```
      sudo bash /tmp/bootstrap_4.51.00.sh apigeeuser=uName apigeepassword=pWord
      ```

      where <var translate="no">uName:pWord</var> are the username and password you received from Apigee.
      If you omit <var translate="no">pWord</var>, you will be prompted to enter it.
   4. Use the `source` command to execute the apigee-service.sh script:

      ```
      source /etc/profile.d/apigee-service.sh
      ```
2. Update the `apigee-machinekey` utility:

   ```
   /opt/apigee/apigee-service/bin/apigee-service apigee-machinekey update
   ```
3. On all Edge nodes, execute the `update.sh` script for the edge process:

   ```
   /opt/apigee/apigee-setup/bin/update.sh -c edge -f configFile
   ```
4. If you are using Apigee mTLS, follow the procedure described in [Upgrade Apigee mTLS](https://docs.apigee.com/private-cloud/v4.51.00/mtls-upgrade). For more information, see [Introduction to Apigee
   mTLS](https://docs.apigee.com/private-cloud/v4.51.00/mtls-intro).

## Security issues fixed

The following security issue has been fixed in this release.

| Issue ID | Description |
|---|---|
| [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. See the [Note about the Apache Log4j vulnerability](https://docs.apigee.com/release/notes/4510003-private-cloud-relnotes#log4j) above. |

## Changes to
[supported software](https://docs.apigee.com/release/supported-software#apigeeedgeforprivatecloudsupportedversions)

There are no changes to supported software in this release.

## Deprecations and retirements

There are no new deprecations or retirements in this release.

## New features

There are no new features in this release.

## Bug fixes

This section lists the Private Cloud bugs that were fixed in this release.

| Issue ID | Description |
|---|---|
| 211001890 | **The Apache Log4j library shipped with Gateway components' third party libraries has been updated to version 2.17.0** |

## Known issues

See [Known issues with Edge for Private Cloud](https://docs.apigee.com/release/known-issues#private-cloud)
for a complete list of known issues.