Express Server and Log4J vulnerabilities

Issue

On December 10, 2021, CVE-2021-44228 was reported, describing an exploit in the Log4j library that allowed a malicious user to run code on an affected system. On December 14, 2021, CVE-2021-45046 was reported, describing a second exploit in Log4j.

Solution

Express Server doesn't use a version of Log4j that is affected by CVE-2021-44228 or CVE-2021-45046.

About Express Server

The Express Server is a high-performance image streaming and geospatial data publishing tool that enables the transfer of large raster data files promptly and efficiently across enterprise GIS environments. The system is capable of processing large aerial images, satellite images, orthophotos, DEMs, and other geospatial raster formats. Express Server allows organizations to transfer only those portions of the image that are necessary, in several resolutions, thereby minimizing the volume of bandwidth consumed and improving the performance of applications. The Express Server is compliant with industry standards and can be integrated seamlessly with GIS systems and web-based mapping applications in addition to cloud infrastructures. The software is intended for providing services to defense agencies, commercial entities, environmental consultancy companies, utility companies, and public organizations that are in need of publishing large amounts of data for online use. The system applies sophisticated data compression mechanisms as well as dynamic mosaicking, and its architecture is highly scalable. The data is distributed safely and it is cached. Whether it is used for managing archives or for distributing data in real time, Express Server allows raster data management to make visualization, collaboration, and making decisions easier.