KiCad affected by log4j security issue?

Software
1

Dear Forum, dear Support-Team,

as a user of KiCad, we are concerned if this is affected by the log4j security issue?
https://logging.apache.org/log4j/2.x/

An answer would be highly appreciated.

Thanks in advance.
Matthias

2

There is no Java code in KiCad.

4 Likes
3

This post makes me depressed.

4

It’s a fair question, the Log4j issue is causing havoc and there is a lot of software and equipment that is wide open.
I’m more worried about my router

1 Like
5

Given the way many router manufacturers deliver their firmware updates, I wouldn’t be surprised if some of them are still vulnerable to shellshock :stuck_out_tongue:

6

Just saw that the Arduino IDE released two versions in quick succession to deal with not just the original log4shell vulnerability but also a subsequently discovered DoS vulnerability. In the end they just ditched log4j:

ARDUINO 1.8.19 2021.12.20 SECURITY HOTFIX RELEASE

[ide]

  • Removed log4j from IDE. Fix CVE-2021-45105, CVE-2021-45046

Though it’s highly unlikely that an individual’s IDE would be targetted. What I’m more concerned about is some business entity that has my personal information, using Java on their Internet facing site, getting hacked and the information exfiltrated.

1 Like
7

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.