Forum Discussion

AnuragJaiswal's avatar
AnuragJaiswal
New Contributor
3 years ago

Is SoapUI affected by Log4j Vulnerability? If yes, what are the actions required for permanent fix?

Hi Team,   I am Anurag from CBA. We are performing vulnerability remediation for all the software we are using and we are reaching out to the corresponding vendors to understand what sort of action...
SOAP
richie's avatar
richie
Community Hero
3 years ago

Hey AnuragJaiswal 

 

Yes any software that runs log4j was open to the security issue reported just before Xmas.

 

I know there was another user on here who's Security Guys wanted the company he worked for to stop using SoapUI/ReadyAPI until an alternative to log4j was found (I think because a couple of weeks after the critical flaw was found, I think on 29th Dec a further high priority flaw was found) - however software is always gonna have flaws - unless you're completely air gapped - there's always a risk.

 

I can only tell you what my company did with their ReadyAPI instances - they just swapped out all the existing log4j files and replaced them with v2.17 files.  I believe v2.16 was produced to fix the critical flaw and v2.17 was released to handle the flaw published on 29th December.

 

SoapUI changes can be pretty slow sometimes.  There's nothing wrong with you overwriting the existing log4j files with the v2.17 ones.

 

That's what we've done across the company I work for.

 

Cheers,

 

Rich

  • AnuragJaiswal's avatar
    AnuragJaiswal
    New Contributor
    3 years ago

    Thanks richie for your response.

    How and where can I get the version 2.17 of Log4j for SoapUI? Do you have a reference link that you can provide?

    Highly appreciate your response.

    Thanks

    Anurag Jaiswal