Menu
I have recently read about the zero-day issue in Log4J. I work with a few applications, written with .NET, that use the log4net logging library, which is based on Log4j.
Does log4net have any similar security vulnerabilities as the CVE-2021-44228 vulnerability to Log4j?
549
It has been discovered that older versions of Log4j are also vulnerable to CVE-2021-4104. Read more about this update by selecting the following link: CVE - CVE-2021-4104. See product specific sections for mitigation steps.
The Apache log4net library is a tool to help the programmer output log statements to a variety of output targets. log4net is a port of the excellent Apache log4j™ framework to the Microsoft® .
The observed attacks from the Apache Log4j vulnerabilities are mostly coin mining, remote shells, red-team activities, and mass-scanning.
Is log4net thread-safe? Yes, log4net is thread-safe.
Does log4net have any similar security vulnerabilities as the CVE-2021-44228 vulnerability to Log4j? Show activity on this post. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. So, no. Log4Net is fine. Show activity on this post.
Understand the risks it poses and the steps to take to secure your enterprise systems against potential associated threats. On December 9, the Apache Software Foundation released a security advisory addressing a remote code execution vulnerability (CVE-2021-44228) affecting its Log4j Java-based logging utility.
I work with a few applications, written with .NET, that use the log4net logging library, which is based on Log4j. Does log4net have any similar security vulnerabilities as the CVE-2021-44228 vulnerability to Log4j?
Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. So, no. Log4Net is fine.
Vulnerability Details: CVE-2021-44228 (CVE Details) and CVE-2021-44228 (CVE) have the following note:
Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
So, no. Log4Net is fine.
107
Apparently it has to use JNDI and JVM. Ports are clear if they don't use those.
Does CVE-2021-44228 impact Log4j ports?
22
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
