Is Appian affected by this log4j vulnerability CVE-2021-44228?

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Peter Lewis — Mon, 07 Feb 2022 16:17:00 GMT

Sorry, unfortunately I don't know much about using log4j in plugins. Hopefully some other posters in the Community will have more context.

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Satyam Singh — Mon, 07 Feb 2022 16:04:50 GMT

Nope, actually i have added updated library of log4j 2.17 in my customer plugin package which has bit different implementation then log4j 1.17.

example:

it has LogManager while initializing class instead of Logger

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Peter Lewis — Mon, 07 Feb 2022 15:37:01 GMT

What do you mean when you say "changing my code as compatible to latest version" - did you install the hotfix or make the changes in a different way?

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Satyam Singh — Mon, 07 Feb 2022 15:31:38 GMT

Hello Peter Lewis,

after log4j upgrade, I am not able to see my logging coming through tomcat.log file.

Even though after changing my code as compatible to latest version of log4j 2.17, not working. Any advice on that ?

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Stefan Helzle — Tue, 14 Dec 2021 06:54:52 GMT

Peter, thanks a lot :-)

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Peter Lewis — Mon, 13 Dec 2021 20:46:09 GMT

Please find this knowledge base article with the latest information on this vulnerability: community.appian.com/.../kb-2204-information-about-the-log4j2-security-vulnerability-cve-2021-44228

Hotfixes are available for self-managed customers with the latest updates to address this vulnerability.

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Stefan Helzle — Mon, 13 Dec 2021 16:13:14 GMT

I assume that the latest hotfixes include this patch. This is what they write in the email. In case you need details, contact Appian.

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

keviny — Mon, 13 Dec 2021 16:09:06 GMT

We have this same question and did not receive communication on the fix. Is there documentation on how to fix this for an on-prem installation?

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Stefan Helzle — Mon, 13 Dec 2021 07:31:50 GMT

Just saw the mail sent on December 12th including the details about which parts of Appian may be affected, available updates and the procedure to update the Appian cloud environments.

Well done :-)

RE: Is Appian affected by this log4j vulnerability CVE-2021-44228?

Stefan Helzle — Mon, 13 Dec 2021 07:25:10 GMT

Peter Lewis: We need official communication about this topic!