Log4J Java Vulnerabilities

Log4j is a widely used Java-based logging framework developed by the Apache Software Foundation. A series of vulnerabilities discovered in Log4j may allow attackers to execute arbitrary code, cause denial-of-service conditions or otherwise compromise affected systems when the vulnerable library is used in specific configurations. The most significant vulnerabilities could enable remote code execution through the processing of specially crafted log messages.

The impact of these vulnerabilities depends on whether a product includes an affected version of the Log4j library and how the library is implemented. We have evaluated our wireless products and development tools for these vulnerabilities, and no action is required. Refer to the Affected Products and Resolution section for additional information.

This page addresses the following Log4j-related vulnerabilities identified by Common Vulnerabilities and Exposures (CVEs):

• CVE-2021-44228 (Log4Shell)
• CVE-2021-44832
• CVE-2021-45046
• CVE-2021-45105

Last Updated: January 2022

Our wireless products are not known to be impacted by the Log4j vulnerabilities listed above.

Development tools, including MPLAB^® X Integrated Development Environment (IDE) and Microchip Studio IDE, are not known to be impacted by these vulnerabilities.

For information regarding our storage management products and related response activities, refer to the Storage Management Response documentation.

• Log4J Security Issues and Known Vulnerabilities
• Apache Log4j Vulnerability Guidance