[SECURITY] Apache Solr affected by Apache Log4J CVE-2021-44228

Due to the discovery of the CVE-2021-44228 vulnerability in Apache Log4j2 which is used in Apache Solr, it is necessary to take countermeasures that will eliminate any potential risk.

As described here: https://logging.apache.org/log4j/2.x/download.html, the vulnerability applies to all versions of Apache Solr using the Log4j2 library. The page lists a number of solutions that will eliminate the problem.

One of these solutions involves manually updating the log4j2 component to version 2.15.0 (or higher). Download Apache Log4j 2 binary (zip) from here: https://logging.apache.org/log4j/2.x/download.html

How to manually replace log4j2 files

In this example, the search component is installed on disk D: in the default folder, on a machine available under DNS name solserver.

1. Download apache-log4j-2.15.0-bin.zip from https://logging.apache.org/log4j/2.x/download.html
2. Stop Webcon BPS Search Service

3. Delete the following files from folder D:\Program Files\WEBCON\WEBCON BPS Search Server\Search Cluster\Solr\contrib\prometheus-exporter\lib\
   - log4j-api-2.13.2.jar
   - log4j-core-2.13.2.jar
   - log4j-slf4j-impl-2.13.2.jar

4. Delete the following files from folder D:\Program Files\WEBCON\WEBCON BPS Search Server\Search Cluster\Solr\server\lib\ext\
   - log4j-1.2-api-2.13.2.jar
   - log4j-api-2.13.2.jar
   - log4j-core-2.13.2.jar
   - log4j-slf4j-impl-2.13.2.jar
   - log4j-web-2.13.2.jar
5. Copy the following files from the downloaded archive:
   - log4j-api-2.15.0.jar
   - log4j-core-2.15.0.jar
   - log4j-slf4j-impl-2.15.0.jar
6. Paste the copied files in folder D:\Program Files\WEBCON\WEBCON BPS Search Server\Search Cluster\Solr\contrib\prometheus-exporter\lib\
7. Copy the following files from the downloaded archive
   - log4j-1.2-api-2.15.0.jar
   - log4j-api-2.15.0.jar
   - log4j-core-2.15.0.jar
   - log4j-slf4j-impl-2.15.0.jar
   - log4j-web-2.15.0.jar
8. Paste the copied files in folder D:\Program Files\WEBCON\WEBCON BPS Search Server\Search Cluster\Solr\server\lib\ext\
9. Start Webcon BPS Search Service
10. Verify whether the search server functions correctly by e.g. opening the following in a browser:
    - http://solrserver:8983
    - http://solrserver:8983/solr/BPS_Activities/query?q=*&rows=1
    - http://solrserver:8983/solr/BPS_Elements/query?q=*&rows=1