# Java Zero Day Question **URL:** \ **Category:** Ignition\ **Created:** [December 10, 2021, 8:43pm UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003 "2021-12-10T20:43:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![TimE](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TimE](https://forum.inductiveautomation.com/u/TimE)\ **Post date:** [December 10, 2021, 8:43pm UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/1 "2021-12-10T20:43:35Z")
I received a question from our IT department about a severe vulnerability in the Log4J utility and they are asking what our risks are. [https://insidexpress.com/technology/zeroday-exploit-for-critical-log4j-bug-poses-a-grave-threat-to-the-internet/](https://insidexpress.com/technology/zeroday-exploit-for-critical-log4j-bug-poses-a-grave-threat-to-the-internet/) Can you provide some insight for my to relay to them? Thank you. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [December 10, 2021, 8:46pm UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/2 "2021-12-10T20:46:20Z")
I think we’re crafting some kind of official statement, but there’s nothing to worry about. Ignition doesn’t use log4j as its logging backend. Both 7.9 and 8.x versions use a different backend called logback instead. Even old unsupported versions of Ignition that _did_ use log4j used version 1.x, which isn’t affected. For anyone interested this is the CVE: [CVE - CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228) ---
**Author:** ![TimE](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TimE](https://forum.inductiveautomation.com/u/TimE)\ **Post date:** [December 10, 2021, 8:53pm UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/3 "2021-12-10T20:53:36Z")
Thank you Kevin, this is good news! ---
**Author:** ![alo.go](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@alo.go](https://forum.inductiveautomation.com/u/alo.go)\ **Post date:** [December 13, 2021, 8:33am UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/4 "2021-12-13T08:33:33Z")
Hello all, We have also received that notice from the IT department. Is version 7.9.10 (b2018112821). affected? ---
**Author:** ![Matrix\_Engineering](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matrix_engineering/32/19781_2.png) [@Matrix\_Engineering](https://forum.inductiveautomation.com/u/Matrix_Engineering)\ **Post date:** [December 13, 2021, 9:04am UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/5 "2021-12-13T09:04:05Z")
No. ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [December 13, 2021, 9:16am UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/6 "2021-12-13T09:16:35Z")
> [@alo.go](#): > > Is version 7.9.10 (b2018112821). affected? Kevin literally said this > [@Kevin.Herron](#): > > Ignition doesn’t use log4j as its logging backend. Both 7.9 and 8.x versions use a different backend called logback instead. ---
**Author:** ![alo.go](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@alo.go](https://forum.inductiveautomation.com/u/alo.go)\ **Post date:** [December 13, 2021, 10:11am UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/7 "2021-12-13T10:11:23Z")
Thanks ---
**Author:** ![Kevin.McClusky](https://avatars.discourse-cdn.com/v4/letter/k/47e85d/32.png) [@Kevin.McClusky](https://forum.inductiveautomation.com/u/Kevin.McClusky)\ **Post date:** [December 18, 2021, 12:04am UTC](https://forum.inductiveautomation.com/t/java-zero-day-question/54003/8 "2021-12-18T00:04:41Z")
Since this is one of the top hits on Google, I thought I'd share our official response. > **[Regarding CVE-2021-44228 - Log4j RCE 0-day](https://support.inductiveautomation.com/hc/en-us/articles/4416204541709-Regarding-CVE-2021-44228-Log4j-RCE-0-day)** > > On December 9th, 2021, a new vulnerability was reported (CVE-2021-44228) against a common Java logging library, “log4j”. This vulnerability makes affected systems susceptible to having remote attac... The most relevant paragraph: > Inductive Automation has conducted a full audit of Ignition’s direct and transitive dependencies to confirm that log4j is not used or included in any supported or unsupported release of Ignition, and as such it is not vulnerable to the RCE outlined in CVE-2021-44228. This includes LTS versions 7.9 and 8.1, as well as all past and non-LTS versions. While Ignition versions 7.8 and prior _did_ use log4j for its logging backend, the version used (1.2.x) is not affected.