log4j

Dear Joachim,

The well known vulnerability of Log4j published in Dec 2021 was never an issue for ARIS Express, because we don't have the affected Log4J version 2 included in ARIS Express. We are using a prior version. Source: Apache Log4j - are we affected? | ARIS BPM Community (ariscommunity.com)

So there is neither a reason for you to remove ARIS Express from your computer, nor do we have see a need to build a new version of ARIS Express.

Cheers
Runè

Dear René

we used also ARIS Express in our company. We deleted ARIS Express from all our computers, because our research showed us, that it uses "log4j__V2.3.jar". 

Log4j is vulnerable from 2.0-beta9 til incl. 2.14.1.

So please tell me why it should not be vulnerable. 

Thanks and best regards

Tobias

Dear René

we used also ARIS Express in our company. We deleted ARIS Express from all our computers, because our research showed us, that it uses "log4j__V2.3.jar". 

Log4j is vulnerable from 2.0-beta9 til incl. 2.14.1.

So please tell me why it should not be vulnerable. 

Thanks and best regards

Tobias

I think Frank Weyand already replied to you here Apache Log4j - are we affected? | ARIS BPM Community (ariscommunity.com)

I can't add anything else except that we also had many "false positives", means, a software found by a scanner which didn't toroughly searched for the real Log4J CVEs but only for the Log4J classes, regardless of version and content.

I hope you get ARIS Express soon be put on a whitelist.

Cheers
Runè

Thank you Runé for this information