Hi Treasured node-red community. Is there any indication from Devs if node-red might be affected by the log4j vulnerability? Tech Solvency: The Story So Far: CVE-2021-44228 (Log4Shell log4j vulnerability). Naturally we already avoid to expose any Node-RED page to the public internet. However it …

[image] Log4J vulnerability General Log4J is a Java Library, not a JavaScript library It will not be used by any node-red apps

As a member of a Java team (during my daily job), I can confirm this. If I hear the word "log4j" once more today, then I am going to bang my head against the wall :wink:

[image] BartButenaers: As a member of a Java team (during my daily job) I'm so sorry for your loss! :frowning: [image] BartButenaers: If I hear the word "log4j" once more today, then I am going to bang my head against the wall Ah, well perhaps be thankful that you don't have it buried…

Thanks for your time with this everyone, appreciate it.

This is a useful link regarding what is impacted: https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/#affected-products

Node-RED

Node-RED Forum

Node red and log4j vulnerability

Core Development

cymplecy 14 December 2021 16:35 2

Topic		Replies	Views
Log4J vulnerability General	1	1381	14 December 2021
More security considerations General	2	1098	6 October 2018
Node-RED compromise hack General security	19	942	23 October 2023
Prototype pollution vulnerability in function DEFNODE General	3	258	26 October 2022
4 high severity vulnerabilities while installing node-red@2.2.2 && 2.1.4 General	2	475	12 May 2022

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Node red and log4j vulnerability

Related topics