log4shell vulnerability - are Stor2rrd & Lpar2rrd affected?

stp

Hello, 

I couldn't find a statement anywhere, so I want to ask it here: 
Are Store2rrd or Lpar2rrd affected by the log4shell / log4j vulnerability (CVE-2021-44228) ?

Thanks, 
Stefan

Pavel

no, we do not use log4j nor log4shell at all.

stp

Thanks for your fast reply!

Pavel

official statements:

https://stor2rrd.com/Log4j-CVE-2021-44228.php

https://lpar2rrd.com/Log4j-CVE-2021-44228.php

enochjohnson

Hi Pavel, I have a virtual machine where we installed the LPAR2RRD and STOR2RRD Virtual appliance from OVF file. When we do a search using Grype (Anchore scanning tool) against this virtual machine, it says that log4j version 2.12.1 is inside of the file /opt/xorux/xormon/xormon.war. I saw the statements that lpar2rrd stor2rrd don't use log4j. I don't know what xormon.war is, so I wanted to see if it's ok to delete, or if it has log4j inside it?  Thank you

Pavel

Hi,

xormon contains log4j-api only which is not vulnerable, problem is in log4j-core which is not used by us.