Shelly Binding

[markus7017 (Markus Michels)]

fyi: If you are not already aware - one more reason to upgrade your OH

openHAB and the log4j security vulnerability

Dear all, You might have read yesterday in the IT press about the critical remote code injection vulnerability in the popular log4j library. This affects a huge amount of Java-based software and servers. openHAB uses log4j as well (as part of Karaf) for logging, so what exactly does this mean for you? First of all: For exploiting the vulnerability, an attacker must have access to your server or at least be able to interact in a way with it that would let openHAB log some of his input. So as l…