Forum Discussion

AnuragJaiswal's avatar
AnuragJaiswal
New Contributor
3 years ago

Is SoapUI affected by Log4j Vulnerability? If yes, what are the actions required for permanent fix?

Hi Team,   I am Anurag from CBA. We are performing vulnerability remediation for all the software we are using and we are reaching out to the corresponding vendors to understand what sort of action...
SOAP
KarelHusa's avatar
KarelHusa
Champion Level 1

Hi AnuragJaiswal ,

besides what richie advised, you can also:

 

Migrate to SoapUI 5.7.0: this version has been released as a reaction to Log4j vulnerability (contains Log4j version 2.17.1). Here you may face some compatibility issues, e.g. in treating JSONPath, as you can find in some other threads.

 

Stay with your old version of SoapUI: check the version of Log4j in your SoapUI/lib directory. I assume it will be some 1.x version which does not include the Log4Shell vulnerability. Please note this version may have its own vulnerabilities. 

 

I chose to upgrade to version 5.7.0.

 

Best regards,

Karel

 

AnuragJaiswal's avatar
AnuragJaiswal
New Contributor
3 years ago

Thanks KarelHusa. That is helpful.

I will check with the team on the compatibility limitations and how it will affect the BAU. 

Thanks again.

Regards

Anurag