Is KNIME working on remediating/upgrading the log4j 0-day exploit? I see the following in my installation: C:\Program Files\KNIME\plugins\org.apache.xmlbeans5_5.0.0.v202104291535\lib\log4j-core-2.14.0.jar Is there a way to remove this plugin until a fix is available?

Neither KNIME Server nor KNIME Analytics Platform (in any version) are affected by this issue. Either it is not using log4j at all or an older version is used that does not have the problem. The log4j 2 reference you found is only used by XMLBeans but this cannot be exploited. Moreover recent Java versions are also not affected by it in any case.

New 0-day Log4j Vulnerability

KNIME Analytics Platform

thor December 13, 2021, 3:21pm 8

7 Likes