OpenAS2 / Discussion / Developers: log4j vulnerability?

log4j vulnerability?

Forum: Developers

Creator: jll

Created: 2021-12-13

Updated: 2021-12-16

jll - 2021-12-13

Should we assume this vulnerability may affect OpenAS2?

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

I see a log4j jar in resources/db/ddlutilis-lib.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Christopher Broderick - 2021-12-16

The library is only used to generate the DDL file for the DB.
Not used in the OpenAS2 server which uses commons logging.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.