"Log4Shell" security vulnerability endangers systems worldwide

[Marc.pol (Marco Troisi)]

“Log4Shell” security vulnerability endangers systems worldwide

Sicherheitslücke “Log4Shell” gefährdet Systeme weltweit

Hello dear community,

since December the BSI has described a security hole in the component Apache Log4j 2.x.

see link

https://www.bsi.bund.de/DE/Themen/Verbübersinnen-und-Verbrauch/Cyber-Sicherheitslage/Schwachstelle-log4Shell-Java-Bibliothek/log4j_node.html

to what extent does this affect Openhab in conjunction with Java and Apache?

[matt1 (Skinah)]

See here

openHAB and the log4j security vulnerability

Dear all, You might have read yesterday in the IT press about the critical remote code injection vulnerability in the popular log4j library. This affects a huge amount of Java-based software and servers. openHAB uses log4j as well (as part of Karaf) for logging, so what exactly does this mean for you? First of all: For exploiting the vulnerability, an attacker must have access to your server or at least be able to interact in a way with it that would let openHAB log some of his input. So as l…

[Marc.pol (Marco Troisi)]

Hello matt1

Cordially for the detailed presentation of the problem, I think the solution steps listed below are good and helpful

should I set it as solved?