Repository navigation
|
Hi guys Is it safe from log4j zero day exploit(https://www.lunasec.io/docs/blog/log4j-zero-day/)? |
Replies: 4 comments 3 replies
|
Hi, Edit: please see the answers from the keycloak team #9065 (comment) I'm wondering the same. Still it has to be confirmed by the keycloak team. |
|
The initial assessment here is that Keycloak is not affected by this issue, but we are still looking into it in more detail. Keycloak does not use log4j-core, but rather just has a Log4j facade onto JBoss Logging manager. |
|
Thanks for the reply. JBoss Logging included in keycloak does however include an affected version of log4j (https://github.com/jboss-logging/jboss-logging/blob/master/pom.xml#L36). Wether that used or not is a different case, by default it seems to be using JBoss LogManager. |
|
Update on that one; and JBoss LogManager does include potentially affected classes from Log4j within its jar. We are still investigating and will provide more details as soon as we can. |
|
According to apache/logging-log4j2#608 (comment) the old log4j (v1) is also affected. I'm not sure if or how that affects Keycloak. |
|
Different vulnerability, but your point is still very valid as 1.x is EOL. |
We've reached a conclusion and Keycloak is NOT affected by this vulnerability. For more details see #9078