STM32CubeMX & STM32CubeIDE

[BenBE]

• Vendor Name: ST Microelectronics
• Product Name: STM32CubeMX / STM32CubeIDE
• Version(s) affected: 6.x
• Status: Unknown
• Update Available: No
• Notes: Contains log4j, could just verify use of log4j v1.2.15 (CVE-2021-4104)
• References: https://www.st.com/en/development-tools/stm32cubemx.html
• Last Updated: 2021-11-26

[iainDe]

Thank you for submitting! Is there official statement or advisory of ST Microelectronics using vulnerable software libraries?

[BenBE]

Seems overall unaffected: https://community.st.com/s/question/0D53W00001Fp7edSAB/stm32cube-tools-and-log4j

Note the potential issues with the STM32CubeMonitor products though …