1 Topic by jny

  • jny
  • Member
  • Offline
  • Registered: 2015-07-03
  • Posts: 6

Topic: Log4j (CVE-2021-44228)

Not sure how to check this, so asking: Is iredmail affected by this?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by Cthulhu

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 815

Re: Log4j (CVE-2021-44228)

no, it does not use java

3 Reply by rbarnes-valco

  • rbarnes-valco
  • Member
  • Offline
  • Registered: 2021-12-14
  • Posts: 1

Re: Log4j (CVE-2021-44228)

Does this hold true for ALL versions of iRedMail or just the latest?  Specifically I am running:

iRedMail    0.9.8
iRedAdmin-Pro    2.9.0 (PostgreSQL)

4 Reply by Cthulhu (edited by Cthulhu 2021-12-15 11:08:15)

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 815

Re: Log4j (CVE-2021-44228)

iredmail never used java, and i guess will never do so aswell

5 Reply by montanelli

  • montanelli
  • Member
  • Offline
  • Registered: 2021-03-23
  • Posts: 48

Re: Log4j (CVE-2021-44228)

There is a log4j implementation for perl. It is not affected by that advisory. It's just the java implementtions of log4j 2.4x (as I understand it).

Some java/jvm/jre implementations (e.g. Lucee) use log4j. But Lucee for example uses log4j 1.2x, which is not affected.

If you are running java, search your .jar files for log4j

e.g.
]# find / -name *.jar | grep log4j
/opt/lucee/tomcat/lucee-server/bundles/log4j-1.2.17.jar
/opt/lucee/tomcat/lucee-server/bundles/log4j-1.2.16.jar

Cthulhu wrote:

iredmail never used java, and i guess will never do so aswell

6 Reply by Cthulhu (edited by Cthulhu 2021-12-15 23:33:47)

  • Cthulhu
  • Member
  • Offline
  • Registered: 2019-06-04
  • Posts: 815

Re: Log4j (CVE-2021-44228)

lucee is not related to iredmail, and Log::Log4perl is NOT log4j, that's a huge difference

the question was only related to iredmail, not to any other software some ppl implemented on their servers

7 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Log4j (CVE-2021-44228)

iRedMail doesn't install any Java programs by default, so it's crystal clear that ALL iRedMail releases are NOT AFFECTED by this log4j thing. BUT if you installed some Java program after iRedMail installation, then you should check with the program vendor to figure out whether the Java program is affected.