Eclipse Community Forums: Sirius » Sirius and Log4Shell

Help

Home

Home » Eclipse Projects » Sirius » Sirius and Log4Shell

Show: Today's Messages :: Show Polls :: Message Navigator

Sirius and Log4Shell [message #1848765]

Thu, 16 December 2021 10:14

Pierre-Charles David

Messages: 662
Registered: July 2009

Senior Member

Hi all,

You are probably aware of the Log4Shell vulnerability by now (see https://www.lunasec.io/docs/blog/log4j-zero-day/ for example).

Just to make it clear: Sirius is not vulnerable to this.

Sirius Desktop uses log4j 1.x (which is not impacted) but only in SWTBot-based tests, not in any runtime bundles deployed in applications.
Sirius Web uses Spring Boot, which is not vulnerable in its default configuration (see https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot).

Unless you use Log4J 2.x explicitly in your own custom code (e.g. in your Java services), or combine Sirius with other products, you should be safe. See this page for the vulnerability status of other Eclipse projects.

Regards,

Pierre-Charles David - Obeo

Need training or professional services for Sirius?
http://www.obeodesigner.com/sirius

Report message to a moderator

Previous Topic:	[ANN] Sirius 6.6.0
Next Topic:	Sirius web start error

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Wed Jun 07 20:26:25 GMT 2023

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter