Log4j vulnerability

thermionic · December 10, 2021, 6:22pm

Are the current Debian/Ubuntu packages vulnerable?

tmortagne · December 11, 2021, 9:27am

XWiki uses Logback as logger implementation and not Log4j (even if some parts go through the log4j API it still ends up in Logback), so it’s not affected.

21137183Mitin · December 12, 2021, 2:20pm

Hi Thomas. Thanks for the quick response. I’ll put it here just in case:

Trefex · December 12, 2021, 3:13pm

@tmortagne is this also for older versions of xWiki ?

mvdschot · December 12, 2021, 6:29pm

Solr is vulnerable, see: Solr™ Security News - Apache Solr

tmortagne · December 12, 2021, 9:13pm

Yes, XWiki never used Log4j 2 implementation and moved from commons-logging to slf4j/logback in 3.1 (2011).

tmortagne · December 12, 2021, 9:19pm

Yes, users of Solr standalone instance should indeed probably think about upgrading it (but I’m not sure if it’s so easy to exploit if the Solr instance is not publicly accessible).

The embedded Solr instance (like any other library embedded in XWiki which use the log4j API) will end up being logged by Logback in practice, which means it’s not vulnerable.

tmortagne · December 13, 2021, 9:04am

Currently working on an official statement regarding this issue, with information about the various tools and distributions in the XWiki ecosystem.

edit: done on Log4J CVE-2021-44228 "Log4Shell" Zero-Day Vulnerability