Hello!
Given that last week information was disclosed regarding an RCE exploit with the log4j library, we are trying to find out if our docker image of Cassandra 3.11 is vulnerable as well.
The exploit link can be found here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
Thanks!
Apache Cassandra uses logback as the default logger, not Log4j so it is not affected by the vulnerability identified in CVE-2021-44228.
In any case even if you switch to using Log4j over SLF4J, SLF4J uses log4j 1.x which is not affected by the vulnerability. The exploit in CVE-2021-44228 allows an attacker to inject a JNDI or LDAP string. Log4J 2.x is vulnerable to the exploit because it performs lookups using the JNDI -- Log4J 1.x does not have this functionality. Cheers!
7 People are following this question.
