log4j vulnerability for Wso2 API manager 1.8.0

Question

We are running WSO2 1.8.0 API Manager(I know it's old :-)) I wanted to check if the latest log4j vulnerability has any patch/fix available for our WSO2 API Manager version we are running. I didn't find any update in the WSO2 security advisory list https://docs.wso2.com/display/Security/2021+Advisories

Log4j security issue - https://logging.apache.org/log4j/2.x/security.html

Appreciate any thoughts on the question.

Thanks

Log4j security issue - https://logging.apache.org/log4j/2.x/security.html

Appreciate any thoughts on the question.

Thanks

user_17669971 · Answer

Updated: here is the official WSO2 link for this CVE, I can't believe I missed this earlier. It appears the answer is that you are not affected. https://docs.wso2.com/pages/viewpage.action?pageId=180948677

(There is a different, older CVE for log4j 1.x but WSO2 has clarified that it does not affect their products: https://docs.wso2.com/display/Security/CVE-2019-17571)

log4j vulnerability for Wso2 API manager 1.8.0

1 Answers