Does Storj use any Java and the new log4j vuln?

Node Operators
1

Does the node operator software or satellite software or anything at Storj lab use Java log4j and the new vuln CVE-2021-44228?

2 Likes
2

@Alexey @jtolio not sure who else might know

3

We are entirely running on golang, so there is not anything that uses log4j :slight_smile:
Thanks for raising the concern/attention for this, its a major flaw affecting millions of hosts/applications world wide :keyboard: :desktop_computer:

3 Likes
4

Been on major incident calls all day going on hour 14 but wanted to make sure my home server was safe as this is the only world facing app I have exposed…

5

Note that Unifi stuff is impacted however. About to start patching that shortly. lol

1 Like
6

Any chance you could be impacted by your cloud hosting providers?

7

There are so many systems that use the Apache Log4j components, websites, Cisco equipment. This requires a full assessment.

1 Like
8

Are there already patches out? (for Unifi)

9

Yes.
https://community.ui.com/releases/UniFi-Network-Application-6-5-54/d717f241-48bb-4979-8b10-99db36ddabe1

1 Like
10
11

@twl another update released.

1 Like
12

Thank you, but now the Cloud connection is down due to AWS having problems, so I can’t update from afar :see_no_evil:

13

Yeah, been a horrible day. O365 has had multiple incidents as well.

1 Like
14

and this morning it was Cloudflare’s turn… Cloudflare is experiencing widespread latency and timeouts
A lot of voip systems use Cloudflare so that would have been interesting…

Bloody hell this year got busy fast. Must be due for another Exchange exploit soon. lol

1 Like
15

Hello - we’ve published a more formal response in the Announcements channel on Log4j. Thanks

3 Likes