# Java security issue (not log4j)? **URL:** \ **Category:** Ignition\ **Tags:** ignition79\ **Created:** [December 14, 2021, 3:32pm UTC](https://forum.inductiveautomation.com/t/java-security-issue-not-log4j/54103 "2021-12-14T15:32:26Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 14, 2021, 3:32pm UTC](https://forum.inductiveautomation.com/t/java-security-issue-not-log4j/54103/1 "2021-12-14T15:32:26Z")
Due to the log4j bug coming out recently a client of ours did a scan of their own system to look for vulnerabilities. Our 7.9.9 Ignition gateway showed up - it’s the first row listed (IP address has been hidden) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/3/f398b1b224d59ca6aec8fed0f36a121355582eb7.png) Our clients IS employee say that one of our packages is we use is no longer supported. Is this something that would be rectified via upgrading? Is that necessary - is this an exploitable/problematic security issue? I can ask for more information if I know what to ask - this is all I’ve been told and sent so far. Thoughts appreciated. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 14, 2021, 3:36pm UTC](https://forum.inductiveautomation.com/t/java-security-issue-not-log4j/54103/2 "2021-12-14T15:36:52Z")
Jetty was upgraded from 9.3.8 to 9.4.24 in 7.9.14. Without a CVE number or version information or just… more information in general, that’s all I can think to offer you. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 14, 2021, 3:39pm UTC](https://forum.inductiveautomation.com/t/java-security-issue-not-log4j/54103/3 "2021-12-14T15:39:23Z")
I have full access to the gateway and can ask for more information form the IS employee - is the CVE number something I would find on the gateway or something their security should be able to tell me? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 14, 2021, 3:40pm UTC](https://forum.inductiveautomation.com/t/java-security-issue-not-log4j/54103/4 "2021-12-14T15:40:26Z")
It would be something security or the scanning tool would tell you. There may be CVEs that apply to the version of Jetty you are using, but are in code or components not used by Ignition. Automated tools aren’t smart enough to make this distinction, they just flag any version number reported in any CVE in their database. You should use this as an excuse to upgrade to 7.9.18 anyway. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [December 14, 2021, 6:31pm UTC](https://forum.inductiveautomation.com/t/java-security-issue-not-log4j/54103/5 "2021-12-14T18:31:54Z")
The answer I received is `it's a end of life CVE so it doesn't state that there is a vulnerability. ` So I guess technically there is nothing vulnerable? I will recommend the upgrade anyways to at least get rid of the warning.