Are the StorSimple devices subject to the Apache Log4j vulnerability?

SSt-0881 1

Are the StorSimple devices subject to the Apache Log4j vulnerability? Do they even run Apache?

Sumarigo-MSFT 46,126 Reputation points Microsoft Employee

2021-12-28T11:35:42.867+00:00

@SSt-0881 Firstly apologies for delay in responding here!

Adding more information to the above response, Are the StorSimple devices subject to the Apache Log4j vulnerability? No

Microsoft published guidance regarding Log4j 2 vulnerability for customers using Azure Data services. Please find the latest information here: Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 The published list shows affected products only. If a product you seek information on is not listed there, it is because it is not impacted by CVE–2021–44228 or CVE–2021–45046 at the time of this publication. Microsoft continuously monitors for potential threats. For products and services not listed, no action is required by you at this time.
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

---------
Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

1 answer

Leon Laude 85,786 Reputation points

2021-12-14T14:46:33.45+00:00

Hi @SSt-0881 ,

As far as I know StorSimple is not affected by the Apache Log4j vulnerability, for more information about guidance on preventing, detecting and hunting this vulnerability, see:
https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

----------

If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!

Best regards,
Leon
Please sign in to rate this answer.
SSt-0881 1 Reputation point

2021-12-14T14:53:14.627+00:00

Thank you for the link, but we need a definitive answer regarding the StorSimple devices. I have the same question sent in to Microsoft StorSimple support, but was hoping to hear from the community while we waited.

Leon Laude 85,786 Reputation points

2021-12-14T15:02:17.567+00:00

None of the Microsoft products ship with Log4j so you are safe, this is mainly related to Java-based applications.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Your answer