Search for answers here or ask a question
4

Log4J Security Vulnerability & Pyramid

There has been a critical notification of a potentially serious vulnerability in the Apache Log4J Java library used extensively in many Java applications world-wide, including Pyramid.

The versions of the Log4J library that are affected by this critical issue are found in "Log4J2" for versions 2.0 through 2.14.1 (as documented in CVE-2021-44228 and described here and elsewhere on the internet). 

Pyramid, however, uses Log4J 1.2.17 which does NOT contain this problem and is therefore not exposed to this vulnerability.

In the next release (2020.22) we will upgrade this component to a new version and correct any issues found in older versions of the Log4J component (which are not considered critical). 

DEC-23-2021 :SEE THE UPDATED POSTING PROVIDING UPDATED REMEDIES FOR THE LOG4J VULNERABILITY

4replies Oldest first
  • Oldest first
  • Newest first
  • Active threads
  • Popular
      • Avi PerezAdmin
      • "making the sophisticated simple"
      • AviPerez
      • 11 mths ago
      • Reported - view

      Kim Jämiä We have now published to this site. 

      Like 1
  • Pyramid version 2020.20.600 contain this file:
    C:\Program Files\Pyramid2018\drivers\hive-jars\log4j-core-2.6.2.jar

    Could you please verify the vulnerability for this version?

    Thanks.

    Like 1
    • Avi PerezAdmin
    • "making the sophisticated simple"
    • AviPerez
    • 11 mths ago
    • Reported - view

    PLEASE SEE THE UPDATED POSTING PROVIDING UPDATED REMEDIES FOR THE LOG4J VULNERABILITY and details on the new 2020.22 RELEASE

    Like