Log4j Expliot JNDI for AEM | Community
Skip to main content
bipin_bitla
Level 2
Dec 11, 2021 3:56 AM UTC
Solved

Log4j Expliot JNDI for AEM

Hi friends,

 

Does this https://nvd.nist.gov/vuln/detail/CVE-2021-44228 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228 vulnerability apply to AEM 6.5 and 6.1 ? Did anyone face any issues with it?

 

The vulnerability is with org.Apache.logging.Log4j.logger  but I see our AEM is using log4j.over.slf4j bundle which is abstract of log4j. But I am not sure that this vulnerability fully applies to AEM as well. 

 

Any recommendation would help.

 

Thanks

Bipin

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    Kiran_Vedantam
    Kiran_VedantamAccepted solution
    New Participant
    Dec 13, 2021 2:31 PM UTC

    All, Check the response from AEM security team here: https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/apache-log4j-remote-code-execution-vulnerability-cve-2021-44228/td-p/434261

     

    AEM seems to be uneffected.

     

    Thanks,

    Kiran Vedantam.

    View reply

    5 replies

    JeetendraASahu
    JeetendraASahu
    New Participant
    Dec 15, 2021 8:55 AM UTC

    Refer to https://logging.apache.org/log4j/2.x/security.html link

     

    Translate
      Kiran_Vedantam
      Kiran_VedantamAccepted solution
      New Participant
      Dec 13, 2021 2:31 PM UTC

      All, Check the response from AEM security team here: https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/apache-log4j-remote-code-execution-vulnerability-cve-2021-44228/td-p/434261

       

      AEM seems to be uneffected.

       

      Thanks,

      Kiran Vedantam.

      Translate
        Magicr
        Magicr
        Level 6
        Dec 13, 2021 10:15 AM UTC

        How about AEM 6.3, 6.4 and 5.x?

        Translate
          AditiVoh
          New Participant
          Dec 12, 2021 1:57 AM UTC

          Hi Adobe,

           

          We are in similar situation we saw a log4j-over-slf4j in one of AEM directory we are using AEM 6.2 are we affected by this vulnerability?

           

          Regards,

          Gerald

          Translate
            satishchitikena
            New Participant
            Dec 11, 2021 1:26 PM UTC

            Aem depfinder not showing any  wrapper or log4j dependencies . Sling log using log back . 

            is there any find out internal implementation using log4j?

            Translate
              Terms & ConditionsAccessibility statement

              Loading footer...