CircleCI and Log4j (CVE-2021-44228)

[wawrzek]

I try to understand if latest CVE for Log4j in any way affect CirecleCI pipeline.

[nbialostosky]

Hi @wawrzek – welcome to Discuss!

We just posted an announcement about this here:

CircleCI / Log4j Information [CVE-2021-44228]

On December 10th, 2021, CircleCI became aware of a vulnerability in the common Java library, log4j. After a thorough review of our codebase, software, and infrastructure, we do not have reason to believe that this vulnerability has been exploited. We have identified 23 repositories and 3 services which either included or referenced the library, and have confirmed that the security vectors which are exposed by this vulnerability are not expressible in our environment. This includes our usage of …

If you have any additional questions, please let me know!

-Nick