# Java Vulnerabilities and CVEs

**URL:** <https://forum.inductiveautomation.com/t/java-vulnerabilities-and-cves/58788>\
**Category:** Ignition\
**Tags:** ignition80, ignition81\
**Created:** [April 25, 2022, 3:31am UTC](https://forum.inductiveautomation.com/t/java-vulnerabilities-and-cves/58788 "2022-04-25T03:31:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hayden](https://avatars.discourse-cdn.com/v4/letter/h/91b2a8/32.png) [@hayden](https://forum.inductiveautomation.com/u/hayden)\
**Post date:** [April 25, 2022, 3:31am UTC](https://forum.inductiveautomation.com/t/java-vulnerabilities-and-cves/58788/1 "2022-04-25T03:31:13Z")

</div>

Hey all,  
We recently had an external company do a security audit on some of our systems. They pulled several CVEs related to Java and Azul Zulu on our Linux systems but strangely not on a windows version.

Our Linux Ignitions are running on version 8.1.7 while the windows version is running on 8.0.17.

I’ve looked through the update release notes and seen that the embedded java has since been updated to a later version. Which we may consider doing to make our client happy. I’m aware the log4j vulnerabilities shouldn’t be an issue as they’re unused, but our client is more worried about appearing to ‘patch’ these issue even if they don’t need it.

But I’m wondering why this other windows Ignition hasn’t got these. Is there something different about the 8.0 that means these java libraries aren’t installed? Or perhaps the way our security is set up on that machine means the scans didn’t pick it up.

Thanks for any thoughts

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [April 25, 2022, 12:32pm UTC](https://forum.inductiveautomation.com/t/java-vulnerabilities-and-cves/58788/2 "2022-04-25T12:32:12Z")

</div>

It’s possible that the scans didn’t pick it up. Another possibility is that the CVE was both introduced and then fixed in a later version. If you can’t provide CVEs for us to reference I’m not sure there’s much more I can tell you.

We continually update the embedded JDK as updates are released, so if you’re concerned about these then an upgrade is the easiest solution.

---

<div class="post-metadata">

**Author:** ![hayden](https://avatars.discourse-cdn.com/v4/letter/h/91b2a8/32.png) [@hayden](https://forum.inductiveautomation.com/u/hayden)\
**Post date:** [April 26, 2022, 1:09am UTC](https://forum.inductiveautomation.com/t/java-vulnerabilities-and-cves/58788/3 "2022-04-26T01:09:08Z")

</div>

Hey,  
The quoted CVEs were

- CVE-2021-3517
- CVE-2021-3522
- CVE-2021-35550
- CVE-2021-35556
- CVE-2021-35559
- CVE-2021-35561
- CVE-2021-35564
- CVE-2021-35565
- CVE-2021-35567
- CVE-2021-35578
- CVE-2021-35586
- CVE-2021-35588
- CVE-2021-35603
- CVE-2019-17571
- CVE-2020-9488
- CVE-2022-23302
- CVE-2022-23305
- CVE-2022-23307

Looks like these are mostly related to some Java CVEs and Apache Log4j, I understand Log4J vulnerabilities aren’t a concern as these aren’t used in Ignition. But our client still gets concerned when these appear in the audits.

Probably I’ll push for an upgrade on the systems