Log4J vulnerability

[florianschendel]

I have not found any signs of log4j in the netbox code and I am almost sure that the netbox is not affected by the log4j vulnerability but I wanted to ask officially.

[kkthxbye-code]

log4j is a java library. Netbox is written in python, so no it is not vulnerable.

[kkthxbye-code]

Redis is also not written in java as it says in your link, not sure what your point is.

[flatzi]

Nginx is also not vulnerable: https://support.f5.com/csp/article/K19026212

[ifoughal]

log4j is a java library. Netbox is written in python, so no it is not vulnerable.

Well, Log4J has been ported and supports multiple languages including C, C++, Python, etc.

[kkthxbye-code]

No, they are not called log4j, and they most definitely don't support jndi. Please let your security team handle this guys, there's clearly some basic knowledge missing here.

[ifoughal]

No, they are not called log4j, and they most definitely don't support jndi.

Thank you for the clarification. You are quite correct.

[florianschendel]

thanks for the feedback

[themmini]

You might be running the web service using apache (httpd) if yes then you will need to apply a mitigation.
https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/

[kkthxbye-code]

No! Apache httpd is not written in java. Apache is a software foundation, which has hundreds of projects under its name. The project that is vulnerable is Apache log4j, which has nothing to do with the Apache http server.

Again I would strongly advise that you consult your security team or an expert consultant if you have no experience.