# Log4j vulnerability and third-party modules

**URL:** <https://forum.inductiveautomation.com/t/log4j-vulnerability-and-third-party-modules/54025>\
**Category:** Ignition\
**Created:** [December 12, 2021, 10:07pm UTC](https://forum.inductiveautomation.com/t/log4j-vulnerability-and-third-party-modules/54025 "2021-12-12T22:07:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matt2](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Matt2](https://forum.inductiveautomation.com/u/Matt2)\
**Post date:** [December 12, 2021, 10:07pm UTC](https://forum.inductiveautomation.com/t/log4j-vulnerability-and-third-party-modules/54025/1 "2021-12-12T22:07:01Z")

</div>

I’ve seen the answers from Kevin regarding the log4j exploit being a non-issue for the core Ignition platform ([here](https://forum.inductiveautomation.com/t/java-zero-day-question/54003) and [here](https://forum.inductiveautomation.com/t/log4j-on-linux-windows/54005)), thank you for those responses they really help ease concerns.

Given Ignition’s modular structure, it still seems theoretically possible that third party modules may introduce this vulnerability. Is there any way to confirm that at the very least the modules listed on the downloads page don’t introduce this vulnerability? These include:

EAM  
Perspective  
Reporting  
SFC  
SQL Bridge  
Symbol Factory  
Tag Historian  
Vision  
Web Browser  
Web Dev

AB  
Logix5000  
BACnet  
DNP3  
Modbus  
OPC COM  
OPC-UA  
Omicron  
OpcCom Tunneller  
SECS/GEM  
Serial Support Client  
Serial Support Gateway  
Siemens  
UDP and TCP

Alarm  
SMS  
Twilio  
Voice

Is there a plan in place to vet the strategic partner modules listed on the Inductive Automation website to ensure that this vulnerability was not introduced by them as well? Any information on this attack vector is appreciated.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [December 12, 2021, 10:09pm UTC](https://forum.inductiveautomation.com/t/log4j-vulnerability-and-third-party-modules/54025/2 "2021-12-12T22:09:16Z")

</div>

We can talk to our strategic partners, but all the modules you listed are ours and they do not include log4j.

The whole idea of a 3rd party bringing log4j as a dependency is very unusual - the logging backend is provided by the Ignition platform and anybody who knows what they are doing would log using the SLF4J logging API and not introduce a parallel logging backend, which would result in an additional set of logs/files being generated.

---

<div class="post-metadata">

**Author:** ![Matt2](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Matt2](https://forum.inductiveautomation.com/u/Matt2)\
**Post date:** [December 12, 2021, 10:10pm UTC](https://forum.inductiveautomation.com/t/log4j-vulnerability-and-third-party-modules/54025/3 "2021-12-12T22:10:49Z")

</div>

That’s great to hear, thank you for your response Kevin!

---

<div class="post-metadata">

**Author:** ![Kevin.McClusky](https://avatars.discourse-cdn.com/v4/letter/k/47e85d/32.png) [@Kevin.McClusky](https://forum.inductiveautomation.com/u/Kevin.McClusky)\
**Post date:** [December 18, 2021, 12:05am UTC](https://forum.inductiveautomation.com/t/log4j-vulnerability-and-third-party-modules/54025/4 "2021-12-18T00:05:52Z")

</div>

Since this is one of the top search engine results, I thought I'd share our official response.

> **[Regarding CVE-2021-44228 - Log4j RCE 0-day](https://support.inductiveautomation.com/hc/en-us/articles/4416204541709-Regarding-CVE-2021-44228-Log4j-RCE-0-day)**
>
> On December 9th, 2021, a new vulnerability was reported (CVE-2021-44228) against a common Java logging library, “log4j”. This vulnerability makes affected systems susceptible to having remote attac...

The most relevant paragraph:

> Inductive Automation has conducted a full audit of Ignition’s direct and transitive dependencies to confirm that log4j is not used or included in any supported or unsupported release of Ignition, and as such it is not vulnerable to the RCE outlined in CVE-2021-44228. This includes LTS versions 7.9 and 8.1, as well as all past and non-LTS versions. While Ignition versions 7.8 and prior _did_ use log4j for its logging backend, the version used (1.2.x) is not affected.