log4j version in Valence

[Theo Kusters]

Hi,

Can you confirm that the log4j version used in Valence isn't vulnerable for:

https://logging.apache.org/log4j/2.x/security.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

Kind regards,
Theo

[robert.swanson]

That's correct. When logging JDBC connection activity, which is activated in Portal Admin > Settings, the Valence remoteDB routine uses log4j 1.2.17. The JNDI lookup vulnerability was introduced in log4j 2.0, which is not included in Valence.

We will be releasing a formal blog post with more details on this topic shortly.