Re: Apache log4j vulnerability

Yes. The main WEKA distribution does not use log4j at all. Some optional
packages that can be installed with the WEKA package manager do use log4j,
but only wekaDeepLearning4j (current version 1.7.2) appears to contain a
version of the log4j library affected by CVE-2021-44228 (the problematic
.jar file is normally located in
wekafiles/packages/wekaDeeplearning4j/lib/log4j-core-2.11.2.jar in the
user's home directory).

I cannot currently see how an attacker would be able to exploit the
vulnerability when WEKA is run as a standard application program and
wekaDeeplearning4j is used, but I am not a cyber security specialist.
Anyway, we will try to make a new release as soon as we can.

In the meantime, to be absolutely sure, it is possible to delete the
problematic .class file from log4j-core-2.11.2.jar (see, for example,
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
):

zip -q -d log4j-core-*.jar
org/apache/logging/log4j/core/lookup/JndiLookup.class

Cheers,
Eibe

On Fri, 7 Jan 2022 at 14:49, Peter Reutemann <[email protected]> wrote:

> As far as I know (based on an email from Eibe), only the
> wekaDeeplearning4j package uses the log4j library and a new release is
> (probably already) in the works.
>
> Cheers, Peter
>
> On January 7, 2022 2:48:11 AM GMT+13:00, "Shifflett, Donald" <
> [email protected]> wrote:
>>
>> I have been ask by my security office to confirm if you software is
>> affected by CVE-2021-44228 (Apache log4j) vulnerability. Can you please
>> confirm if this is an issue with Weka.
>>
>>
>>
>> ------------------------------
>>
>> IMPORTANT WARNING: The information in this message (and the documents
>> attached to it, if any) is confidential and may be legally privileged. It
>> is intended solely for the addressee. Access to this message by anyone else
>> is unauthorized. If you are not the intended recipient, any disclosure,
>> copying, distribution or any action taken, or omitted to be taken, in
>> reliance on it is prohibited and may be unlawful. If you have received this
>> message in error, please delete all electronic copies of this message (and
>> the documents attached to it, if any), destroy any hard copies you may have
>> created and notify me immediately by replying to this email. Thank you.
>> Geisinger Health System utilizes an encryption process to safeguard
>> Protected Health Information and other confidential data contained in
>> external e-mail messages. If email is encrypted, the recipient will receive
>> an e-mail instructing them to sign on to the Geisinger Health System Secure
>> E-mail Message Center to retrieve the encrypted e-mail.
>>
> --
> Peter Reutemann
> Dept. of Computer Science
> University of Waikato, NZ
> +64 (7) 858-5174 (office)
> +64 (7) 577-5304 (home office)
> http://www.cms.waikato.ac.nz/~fracpete/
> http://www.data-mining.co.nz/.
> _______________________________________________
> Wekalist mailing list -- [email protected]
> Send posts to [email protected]
> To unsubscribe send an email to [email protected]
> To subscribe, unsubscribe, etc., visit
> https://list.waikato.ac.nz/postorius/lists/wekalist.list.waikato.ac.nz
> List etiquette:
> http://www.cs.waikato.ac.nz/~ml/weka/mailinglist_etiquette.html
>

_______________________________________________
Wekalist mailing list -- [email protected]
Send posts to [email protected]
To unsubscribe send an email to [email protected]
To subscribe, unsubscribe, etc., visit https://list.waikato.ac.nz/postorius/lists/wekalist.list.waikato.ac.nz
List etiquette: http://www.cs.waikato.ac.nz/~ml/weka/mailinglist_etiquette.html