Ce site disposera de fonctionnalités limitées pendant que nous effectuons des opérations de maintenance en vue de vous proposer un meilleur service. Si un article ne règle pas votre problème et que vous souhaitez poser une question, notre communauté d’assistance est prête à vous répondre via @FirefoxSupport sur Twitter, et /r/firefox sur Reddit.

Avatar for Username

Rechercher dans l’assistance

Évitez les escroqueries à l’assistance. Nous ne vous demanderons jamais d’appeler ou d’envoyer un SMS à un numéro de téléphone ou de partager des informations personnelles. Veuillez signaler toute activité suspecte en utilisant l’option « Signaler un abus ».

En savoir plus

Ce sujet de discussion a été archivé. Veuillez poser une nouvelle question si vous avez besoin d’aide.

Apache Log4J Critical Vulnerability

milo.fisk
milo.fisk
more options

Good afternoon,

Is there an impact to the Mozilla Firefox application from the newly discovered Apache Log4J Critical Vulnerability (Log4J version 2.14.1 CVE-2021-44228)?

Can you please confirm if Mozilla Firefox is exposed to this vulnerability and if it is, then do you have an availability date of the patch to your codes?

Thanks, Milo

Good afternoon, Is there an impact to the Mozilla Firefox application from the newly discovered Apache Log4J Critical Vulnerability (Log4J version 2.14.1 CVE-2021-44228)? Can you please confirm if Mozilla Firefox is exposed to this vulnerability and if it is, then do you have an availability date of the patch to your codes? Thanks, Milo

Toutes les réponses (3)

Amelia
Amelia
more options

Hello,

I do not believe that this exploit was ever possible (except for java web applets), as Firefox is written in c++ (I believe there is rust in there too)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

This is about a specific Apache application that companies can run to log details about visitors on their servers. Firefox is a web browser and doesn't use this software, so unless you own a website that uses this Apache Log4J software then there is nothing to worry.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Hi Milo, if you conduct a search for log4j in the Firefox source code on https://searchfox.org/mozilla-release/source/, you will find that Firefox uses a JavaScript module named log4js. Despite the name similarity, from what I read, it does not have the problematic features of the log4j Java program. Here's what I found:

Let me know if you discover anything concerning.