log4j vulnerability?

[elvisimprsntr]

Any comment from iXsystems? Or are we intentionally maintaining OPSEC?

Critical RCE Vulnerability Updates (log4j - CVE-2021-44228) | Huntress

Read about how our team investigated CVE-2021-44228, a critical vulnerability that was affecting a Java logging package.

www.huntress.com

 

[Samuel Tai]

Running find / -name log4j* -print on my 12.0-U7 system results in no hits. I don't think it's part of a vanilla install. However, that notice says ElasticSearch relies on log4j, so anyone who has installed ES in a jail will need to take precautions. Just off the top of my head, Graylog relies on ES, as does the SpotLight search for SMB shares.

 

[Sgutha]

Our TrueNAS is on 12.0-U5.1. How do we check the vulnerability?

 

[Patrick M. Hausen]

TrueNAS does not use any Java components. What would you want to check if the vulnarable software clearly isn't there?

 

[Sgutha]

TrueNAS does not use any Java components. What would you want to check if the vulnarable software clearly isn't there?

Thank you Patrick!! I am new to TrueNAS and was just making sure this vulnerability has no effect on our systems

 

[JoeAtWork]

TrueNAS does not use any Java components. What would you want to check if the vulnarable software clearly isn't there?

TrueNAS Scale?