log4j - 如何为 Artifactory 替换/更新 log4j？

Question

JFrog有更换/升级log4j模块的说明吗？

Answer 1

这是 JFrog 的正式回答。免责声明，我在 JFrog 工作

On 10 December 2021, a RCE (remote code execution) exploit was exposed on several versions of the Apache Log4j 2 utility.

Affected code exists in log4j core libraries: log4j-core-*.jar, versions 2.0 to 2.14.1.

Following internal research and validation by the JFrog Security and R&D teams, we can confirm that JFrog services are not affected by this vulnerability (CVE-2021-44228). First, we have validated that JFrog services are not configured to implement the log4j-core package. Additionally, we can confirm that the JDK version used in JFrog services (e.g. Artifactory) contain default protection against remote class loading via JNDI objects. Therefore, no action is required by JFrog customers regarding this issue for JFrog solutions.

JFrog Security and Xray product teams have updated the Xray database with CVE information regarding this vulnerability, and this information will be available for Xray customers to assist in detection and remediation across customer portfolios.

JFrog has examined and validated that none of the following products reference the vulnerable libraries:

Artifactory 6.x and 7.x, and the accompanying Access service

• Xray
• Distribution
• Mission Control
• Insights

来源:GENERAL: JFrog Services Are Not Affected by Vulnerability CVE-2021-44228