Gerne will ich an dieser Stelle unsere aktuellen Erkenntnisse zur Log4Shell-Lücke zusammentragen:
Talend Components
Die Talend Components for enaio®, for yuuvis® verwenden in der Standardeinstellung Logback (und nicht log4j). Log4j kann dort jedoch aktiviert werden. Wir liefern keine betroffene Versionen von log4j mit aus, wer hier in den Strecken allerdings JARs oder andere Komponenten nachlädt oder dritte Systeme anbindet, sollte sich die erzeugten Strecken auf betroffene Versionen hin anschauen.
enaio® und yuuvis®
enaio® und yuuvis® sind lt. Optimal Systems nicht betroffen, Stand 15.12.2021. Details finden sich im Serviceportal des Herstellers.
Embedded Office
ONLYOFFICE, wie im Embedded Office for enaio® oder yuuvis® im Einsatz, ist laut Security Bulletin des Herstellers nicht betroffen:
ONLYOFFICE Docs (Document Server) doesn’t use the log4j library and that’s why is not affected by the important security issue in log4j. This applies for all installation types of the editors.
ONLYOFFICE Document Server uses a JavaScript library called log4js. This is a different framework specially created to work with Node.js. It is already verified that log4js does not have the mentioned issue.
ActiveMQ Classic
ActiveMQ Classic ist laut Apache nicht betroffen, siehe deren News zu CVE-2021-44228:
CVE-2021-44228 was recently announced and it has caused quite a bit of traffic on the mailing lists and in Jira from users curious about its impact on both ActiveMQ “Classic” and Artemis. In short, CVE-2021-44228 has no impact on any ActiveMQ broker because no ActiveMQ broker uses any version of Log4j2. To reiterate, no action is required to mitigate CVE-2021-44228.
ActiveMQ “Classic” does use Log4j for logging, but the latest versions (i.e. 5.15.15 and 5.16.3) use Log4j 1.2.17 which is not impacted by CVE-2021-44228. This version of Log4j has been used since 5.7.0. The upcoming ActiveMQ 5.17.0 will use Log4j2, but the pull request will be updated to use Log4j 2.15.0 before merging.
ActiveMQ Artemis does not use Log4j for logging. However, Log4j 1.2.17 is included in the Hawtio-based web console application archive (i.e. web/console.war/WEB-INF/lib). Although this version of Log4j is not impacted by CVE-2021-44228 future versions of Artemis will be updated so that the Log4j jar is no longer included in the web console application archive.
