Eclipse Community Forums: Sirius » Sirius and Log4Shell

Home » Eclipse Projects » Sirius » Sirius and Log4Shell

Thu, 16 December 2021 05:14

Eclipse User

Hi all,

You are probably aware of the Log4Shell vulnerability by now (see https://www.lunasec.io/docs/blog/log4j-zero-day/ for example).

Just to make it clear: Sirius is not vulnerable to this.

Sirius Desktop uses log4j 1.x (which is not impacted) but only in SWTBot-based tests, not in any runtime bundles deployed in applications.
Sirius Web uses Spring Boot, which is not vulnerable in its default configuration (see https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot).

Unless you use Log4J 2.x explicitly in your own custom code (e.g. in your Java services), or combine Sirius with other products, you should be safe. See this page for the vulnerability status of other Eclipse projects.

Regards,

Previous Topic:	[ANN] Sirius 6.6.0
Next Topic:	Sirius web start error

Goto Forum:

-=] Back to Top [=-

Current Time: Thu Jul 10 04:45:08 EDT 2025

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter