Joomla 3.10.3 susceptible for log4j zero day exploit? Topic is solved

[Tom6293]

Dear All,

Given the serious warnings about the recently discovered log4j zero day exploit, I am a bit concerned that my website running Joomla 3.10.3 might be at risk.

Does anyone know, if Joomla 3.10.3 is in principle at risk or not?
If so, are than any recommendations on how to deal with the current situation?

Thanks
Tom

[mandville]

ask your server host to patch it if used. your server software.
tell them to look at this apache release for server software.
https://logging.apache.org/log4j/2.x/security.html

[Richard67]

log4j is a logging library for Java (not Javascript) which is maintained by apache.org, but it has nothing to do with the apache web server.

That means Joomla is safe as long as you don't use a 3rd party extension which for some reason uses Oracle Java formerly Sun Java.

[Tom6293]

Thanks mandville and Richard67,

You made my day .

Regards
Tom

[Richard67]

For completeness, here the official list of Apache products and if they are affected or not: https://blogs.apache.org/security/entry/cve-2021-44228

For product "Apache HTTP Server (httpd)" they show "Not affected".