Is the log4j vulnerability an issue in cuba?

[eparamo (Eduardo Paramo)]

Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit

[jreznot (Yuriy Artamonov)]

As far as I understand, no, because CUBA Platform uses logback as logging engine, and does not have log4j-core dependency on Log4j version 2.0

[ryan.widmer1 (Ryan Widmer)]

Hi Yuriy,

As I understand it, there is a log4j 1.2 dependency in CUBA and that also has a similar type of vulnerability.

CVE-2019-17571 : Included in Log4j 1.2 is a SocketServer class that is...

Can you comment on the exposure to this vulnerability?

Thanks.

[hanbing.yin (Bryan Yin)]

Please check this post:

On Log4j security vulnerability

Hello everyone, The disastrous security vulnerability has been found recently: Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package | LunaSec CUBA platform, as well as Jmix, does not use the Log4j library directly and does not bring it through transitive dependencies. If you run this command: ./gradlew :app-core:dependencies | grep log4j ./gradlew :app-web:dependencies | grep log4j you may see only the interface adapter: org.slf4j:log4j-over-slf4j:1.7.29 The vuln…