Zero-day exploit for Log4j

[ahorn]

Hi,
I have seen, that shinyproxy ist using the log4j library. Is it affected by the zero.day exploit

New zero-day exploit for Log4j Java library is an enterprise nightmare

and what steps are needed for this case?

Thanks,
Achim

[tverbeke]

Hi @ahorn

See https://github.com/openanalytics/shinyproxy/issues/346 for the full picture. In short: ShinyProxy is not affected. The ShinyProxy operator was vulnerable and a new version with a fix has been immediately released (v1.0.1).

Best,
Tobias

[ahorn]

Thanks a lot for this quick clarification.