bug#52707: Log4j Shell Vulnerability

bug#52707: Log4j Shell Vulnerability

[Terry,Samantha]

[-- Attachment #1.1: Type: text/plain, Size: 829 bytes --]

I'm sure you are well aware of the vulnerability with Log4j.  We are needing to determine if the application Emacs is vulnerable.  If so, do you plan on creating a patch or have a plan to patch?

Sam Terry
Research/Willow/Beacon/Therapy Plans - IT Manager
Sanford Health Technology Solutions
Route: 5012| O: 605.328.7310

[cid:image001.png@01D7F64C.2A05F5A0]

-----------------------------------------------------------------------
Confidentiality Notice: This e-mail message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
privileged and confidential information.  Any unauthorized review, use,
disclosure or distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply e-mail and destroy
all copies of the original message.

[-- Attachment #1.2: Type: text/html, Size: 3279 bytes --]

[-- Attachment #2: image001.png --]
[-- Type: image/png, Size: 11187 bytes --]

bug#52707: Log4j Shell Vulnerability

[Eli Zaretskii]

> From: "Terry,Samantha" <Samantha.Terry@SanfordHealth.org>
> Date: Tue, 21 Dec 2021 15:21:42 +0000
> 
> I’m sure you are well aware of the vulnerability with Log4j.  We are needing to determine if the application
> Emacs is vulnerable.  If so, do you plan on creating a patch or have a plan to patch?

What does Log4j have to do with Emacs?

bug#52707: Log4j Shell Vulnerability

[Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors]

"Terry,Samantha" <Samantha.Terry@SanfordHealth.org> writes:

> I'm sure you are well aware of the vulnerability with Log4j.  We are
> needing to determine if the application Emacs is vulnerable.  If so,
> do you plan on creating a patch or have a plan to patch?

I've grepped for "log4j" in the Emacs repository and it didn't return
any results, so I'd say Emacs is not vulnerable.

bug#52707: Log4j Shell Vulnerability

[Dmitry Gutov]

On 21.12.2021 18:21, Terry,Samantha wrote:
> I’m sure you are well aware of the vulnerability with Log4j.  We are 
> needing to determine if the application Emacs is vulnerable.

It does not. Emacs doesn't use Java in its implementation, nor JVM itself.