Download Free Book a demo

JDisc Discovery and Log4j – CVE-2021-44228

By: Thomas Trenz | Date: December 14, 2021 | Comment: 0 | Category: Development News

Dear JDisc users,

I am pretty sure that you are aware of the log4j security issue CVE-2021-44228. JDisc Discovery is mainly written in Java and we have investigated whether we are affected. One external library (yavijava – a library to access VMware ESX and VSphere servers) uses log4j in version 1.2.17.

We have investigated the information and we found out that log4j 1.2.x is also affected, but only with a special configuration. The JMSAppender must be configured in order to have a similar vulnerability like is CVE-2021-44228. JDisc Discovery is not using the JMSAppender and therefore, we conclude that JDisc Discovery is not affected even though yavijava uses log4j 1.2.

However, we decided to remove the affected log4j library completely and replace it with the SLF4J framework. Starting with build 5092 released on Dec. 14th, we have removed the usage of the affected log4j component completely from our project!

Cheers,
Thomas

About The Author

Thomas Trenz

Thomas Trenz is one of the founders and CEO of JDisc GmbH, the company behind JDisc Discovery, an enterprise-class agentless network discovery and IT asset management solution used by organizations around the world.

With more than 25 years of experience in network discovery, IT asset management, and enterprise infrastructure, Thomas has dedicated his career to helping organizations gain complete visibility into increasingly complex IT environments. Since founding JDisc in 2009, he has led the development of a platform that combines deep technical capabilities with a strong focus on usability, accuracy, and customer success.

Thomas regularly writes about network discovery, IT inventory, CMDB, cybersecurity, software asset management, cloud migration, and emerging trends in enterprise IT. His articles focus on practical solutions that help IT teams improve visibility, strengthen security, and make better infrastructure decisions.

When he's not working on the next JDisc Discovery release, Thomas enjoys exploring new technologies and discussing the future of enterprise IT with customers and partners worldwide.

Leave a Reply

Your email address will not be published. Required fields are marked *