Hi,
I understood that Aris Express was somehow effected by the log4j issue.
I had to delete ARIS Express as communicated by my organization.
Ist it OK to install it again?
Best regards, Joachim
Dear Joachim,
The well known vulnerability of Log4j published in Dec 2021 was never an issue for ARIS Express, because we don't have the affected Log4J version 2 included in ARIS Express. We are using a prior version. Source: Apache Log4j - are we affected? | ARIS BPM Community (ariscommunity.com)
So there is neither a reason for you to remove ARIS Express from your computer, nor do we have see a need to build a new version of ARIS Express.
Cheers
Runè
Dear René
we used also ARIS Express in our company. We deleted ARIS Express from all our computers, because our research showed us, that it uses "log4j__V2.3.jar".
Log4j is vulnerable from 2.0-beta9 til incl. 2.14.1.
So please tell me why it should not be vulnerable.
Thanks and best regards
Tobias
Dear René
we used also ARIS Express in our company. We deleted ARIS Express from all our computers, because our research showed us, that it uses "log4j__V2.3.jar".
Log4j is vulnerable from 2.0-beta9 til incl. 2.14.1.
So please tell me why it should not be vulnerable.
Thanks and best regards
Tobias
I think Frank Weyand already replied to you here Apache Log4j - are we affected? | ARIS BPM Community (ariscommunity.com)
I can't add anything else except that we also had many "false positives", means, a software found by a scanner which didn't toroughly searched for the real Log4J CVEs but only for the Log4J classes, regardless of version and content.
I hope you get ARIS Express soon be put on a whitelist.
Cheers
Runè