Is CheckMK affected? - Log4j RCE Vulnerability

[jalf2]

As many of you are probably aware, a major vulnerability was found in a Java logging package called logJ4. (huntress.com). A large number of products are affected including Apache to Ubiquiti Unifi Network Application (see article).

Is CheckMK using the log4j library and/or is it affected by this vulnerability?

Also, good luck to all the sysadmins out there patching everything.

[andreas-doehler (Andreas)]

@jalf2

Is CheckMK using the log4j

No there is no Java inside here
You can have a look at the source and all the included libraries here.

[fayepal (Faye)]

Hi jalf2,

Lars shared an official update about it today:

Checkmk not affected by Log4shell

Dear Checkmk users, we surely don’t need to tell you what Log4shell is. Some of you will even have spent your weekend with it. Just a short update from us on the subject: Checkmk itself is not affected by the vulnerability. The Checkmk appliance is not affected by the vulnerability. We wish you all the best in these busy days.

Cheers,
Faye