Forum Discussion

Umesh_Parab's avatar
Umesh_Parab
3 years ago

LogicMonitor collectors running vulnerable version of Log4j are affected by "Log4shell" CVE-2021-44228 vulnerability?

LogicMonitor collectors running vulnerable version of Log4j are affected by "Log4shell" CVE-2021-44228 vulnerability? If no, can you please explain how?  
nolimit99rbs's avatar
nolimit99rbs
3 years ago
4 hours ago, Mosh said:

@Michael Rodrigues@Stuart Weenig

For info, Log4J 2.16 also have a exploitable vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://logging.apache.org/log4j/2.x/security.html

We are upgrading all of our own enterprise products to use 2.17.  Will LogicMonitor be upgrading to 2.17?

2nd this. Though the vulnerability is less severe, does LogicMonitor plan to update to 2.17 given the high visibility of these vulnerabilities? If so, when can we expect an updated collector?

Thank you