Log4j vulnerability.

[Gambalunga]

Does Chevereto have a vulnerability to the Java Log4j library?
If so is there anything that we need to do about it?
The issue is covered in this blog article https://www.lawfareblog.com/whats-deal-log4shell-security-nightmare

 

[Rodolfo]

Does Chevereto have a vulnerability to the Java Log4j library?

No, as we don't use Java at all. We use PHP.

Note that other software in your server may be Java-based and therefore exposed to this. The recommendation for everybody is to update the server libraries and packages asap.

 

[JakeSully]

No, as we don't use Java at all. We use PHP.

Note that other software in your server may be Java-based and therefore exposed to this. The recommendation for everybody is to update the server libraries and packages asap.

True, but maybe he meant that if the Chevereto is vulnerable in a way where people can use it to upload a java log4j library so when it get's uploaded it executes into server and does damage. That is what he probably means and wonders if in this case Chevereto is protected against such attacks. This can be done some times even if site uses PHP and not java.

 

[Rodolfo]

people can use it to upload a java log4j library so when it get's uploaded it executes into server and does damage

You can't infect a system the way you described it, at least not for the vulnerability being discussed here. The vuln exploits Java software using log4j, Chevereto is not Java software and it doesn't uses log4j.