Re: Is FOP impacted by the Log4shell vulnerability?
Matt Kynaston <[email protected]>
| Newsgroups | gmane.text.xml.fop.user |
|---|---|
| Message-ID | <CAKBO4j8OZe0-_BjgpNNmgX+BW+XxusJaKwmHfVEzhJMxVKWG1g@mail.gmail.com> |
From what I can tell (I just use the library) it doesn't depend on log4j itself. However, given that the library is typically included in other applications and that may well use a vulnerable version, your best bet is to check the actual jars / wars with a tool like at https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/#3-determine-if-you-are-impacted-by-log4shell If you've got the source code of the application, you should also be able to view all dependencies with `mvn dependency:tree` and see if impacted versions of log4j show up there. Best of luck. On Mon, 13 Dec 2021 at 14:46, Bryan K. Walton <[email protected]> wrote: > Hi, is Apache FOP susceptible to the Log4shell vulnerability that is > making the rounds right now? > > Thanks! > Bryan Walton > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > -- Matt Kynaston Lead Developer Tel: +441225851666 www.claritum.com Claritum Limited. Registered Office: 37 Great Pulteney Street, Bath, BA2 4DA Registered in England and Wales 3878694