log4shell vulnerability - are Stor2rrd & Lpar2rrd affected?

stp · December 2021

Hello,

I couldn't find a statement anywhere, so I want to ask it here:
Are Store2rrd or Lpar2rrd affected by the log4shell / log4j vulnerability (CVE-2021-44228) ?

Thanks,
Stefan

Pavel · December 2021

no, we do not use log4j nor log4shell at all.

stp · December 2021

Thanks for your fast reply!

Pavel · December 2021

official statements:

https://stor2rrd.com/Log4j-CVE-2021-44228.php

https://lpar2rrd.com/Log4j-CVE-2021-44228.php

enochjohnson · December 2021

Hi Pavel, I have a virtual machine where we installed the LPAR2RRD and STOR2RRD Virtual appliance from OVF file. When we do a search using Grype (Anchore scanning tool) against this virtual machine, it says that log4j version 2.12.1 is inside of the file /opt/xorux/xormon/xormon.war. I saw the statements that lpar2rrd stor2rrd don't use log4j. I don't know what xormon.war is, so I wanted to see if it's ok to delete, or if it has log4j inside it? Thank you

Pavel · December 2021

Hi,

xormon contains log4j-api only which is not vulnerable, problem is in log4j-core which is not used by us.

log4shell vulnerability - are Stor2rrd & Lpar2rrd affected?

Comments

Howdy, Stranger!

Categories

In this Discussion