Log4Shell vulnerability fixed?

pjgi4d · December 13, 2021, 1:28pm

Hello,

I chose the group that seemed the most appropriate among the choices...

I was just curious if the "Log4Shell" vulnerability announced last week applies to Hubitat, and if so, when a fix is planned. I'm running 2.3.0.119.

Thanks,
Paul

gopher.ny · December 13, 2021, 1:47pm

Pre-2.3.0.119 versions make HTTP request as described in the CVE, but do not execute remote code. JRE version installed on the hubs prevents remote code loading.

2.3.0.119 has an updated log4j version that prevents HTTP requests as well.

brad5 · December 13, 2021, 2:56pm

Thanks. You were asking what was on my mind as well.

pjgi4d · December 16, 2021, 3:57am

Thank you!

endorphin_junkie · December 20, 2021, 6:48am

Can you explain this statement? That's a very interesting statement that has no obvious implementation in any known version of Java. Do you build your own?