Summary
- vScope is not using Log4j2
- vScope is not using JNDI or JMSAppender
…and is not affected by neither CVE-2021-44228 nor CVE-2021-4104.
Background
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. It allows an attacker to execute arbitrary code by injecting attacker-controlled data into a logged message.
Read more at:
https://www.cve.org/CVERecord?id=CVE-2021-44228
Is vScope affected?
vScope uses Log4j 1.x which is not affected by CVE-2021-44228 (http://slf4j.org/log4shell.html). As Log4j 1.x does not offer the look-up mechanism used in the exploit, it does not suffer from CVE-2021-44228.
There has been another CVE created for Log4j 1.x, CVE-2021-4104, which states:
“…Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.”
vScope is not configured to use JNDI or JMSAppender and is therefore not affected of CVE-2021-4104.
We carefully follow this issue and will update this post if any important news surface.
If you have any questions you can reach out to customersuccess@infrasightlabs.com.