Is shiny-server using Log4j?

rstudio / shiny-server

Host Shiny applications over the web.

https://rstudio.com/shiny/server

Other

712 stars 290 forks source link

Is shiny-server using Log4j? #508

Closed KasperSkytte closed 2 years ago

KasperSkytte commented 2 years ago

Just to be safe. Is shiny-server in any way using Log4j so that it might be affected by the recent Log4j RCE vulnerability? https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/

mlane3 commented 2 years ago

No but shinyproxy had it accidently left in there code: https://github.com/openanalytics/shinyproxy An shinycannon does: https://github.com/rstudio/shinycannon

jcheng5 commented 2 years ago

@mlane3 is correct: shiny-server doesn't use log4j; and shinycannon (load testing client) does, we're working on an update for that.

mlane3 commented 2 years ago

I wanted to add a comment her that I am really proud of the work you do @jcheng5 Please share with your collegues. If this reopens the thread then please close it.

Thank you for you help.