Log4j 2 vulnerability?

[MarkC]

Hi,

We note that a high severity vulnerability (CVE-2021-44228) impacting multiple versions of Apache Log4j 2 has just been disclosed, and further note that XNAT uses Log4j via the log4j-over-slf4j library, so can the developers indicate whether we need to worry please? We think that we don't, as it seems that the log4j-over-slf4j jar file bundled with XNAT 1.8 is still using Log4j 1, but we just wanted to make sure.

Best regards,

Mark

[Chris Smith]

Came here to ask the exact same question.  Link if anyone needs more info. 

https://nakedsecurity.sophos.com/2021/12/10/log4shell-java-vulnerability-how-to-safeguard-your-servers/

Chris

[Herrick, Rick]

The log4j-over-slf4j library actually eliminates log4j by providing the classes and methods for log4j compatibility then routing those calls into slf4j, which is itself just a façade (“slf” stands for “Simple Logging Façade”) on top of whatever implementation is used for logging. In XNAT’s case, the logging implementation is logback, not log4j. And XNAT doesn’t include log4j2 at all.

 

XNAT does not have exposure to this vulnerability.

 

-- 

Rick Herrick

XNAT Architect/Developer

Computational Imaging Laboratory

Washington University School of Medicine

 

 

From: xnat_di...@googlegroups.com <xnat_di...@googlegroups.com> on behalf of MarkC <mark.c...@gmail.com>
Date: Friday, December 10, 2021 at 5:32 AM
To: xnat_discussion <xnat_di...@googlegroups.com>
Subject: [XNAT Discussion] Log4j 2 vulnerability?

* External Email - Caution *

--
You received this message because you are subscribed to the Google Groups "xnat_discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/e3be6950-01e5-46f5-b347-67f904a1c9ecn%40googlegroups.com.

 

---

The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

[MarkC]

Many thanks for the confirmation Rick.

Best wishes,

Mark

[Tina Guan]

Thank you Rick for confirming that the application has no exposure!

I have another question. looks the system has liblog4j1.2-java and liblog4j2-java installed. will it affect the XNAT application if I upgrade the package to its latest version?

[Herrick, Rick]

No. XNAT uses no external dependencies or libraries for logging functionality.

To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/019cccdd-f689-4c15-8db5-ff2cef762eean%40googlegroups.com.