Kaazing

Delivering real-time digital business

Kaazing Gateway and Log4j Vulnerability CVE-2021-44228

December 21, 2021

The version of log4j (1.2.17, also referred to as log4j1) used in the Kaazing Gateway/KWIC is not affected by the vulnerability in CVE-2021-44228. As stated by Apache here https://logging.apache.org/log4j/2.x/security.html, "Log4j 1.x is not impacted by this vulnerability".

Official statements from Microsoft and Amazon regarding their use of log4j1:

Microsoft: https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/, "Systems running on Log4j 1.x are not impacted by these vulnerabilities."

Amazon: Amazon is using log4j version 1.2.17 for Amazon Kafka in their MSK product, which they have stated here https://aws.amazon.com/security/security-bulletins/AWS-2021-006/, "Please note that the builds of Apache Kafka and Apache Zookeeper offered in MSK currently use log4j 1.2.17, which is not affected by this issue."

The use of log4j 1.2.17 in Kaazing Gateway/KWIC is not impacted by CVE-2021-44228. We have no current plans to upgrade from log4j1 to log4j2.

Privacy Statement Terms of Service