Este site irá ter funcionalidade limitada enquanto fazemos manutenção para melhorar a sua experiência. Se um artigo não resolve o seu problema e quiser colocar uma questão, temos a nossa comunidade de apoio à espera de o ajudar em @FirefoxSupport no Twitter, /r/firefox no Reddit.

Avatar for Username

Pesquisar no apoio

Evite burlas no apoio. Nunca iremos solicitar que telefone ou envie uma mensagem de texto para um número de telefone ou que partilhe informações pessoais. Por favor, reporte atividades suspeitas utilizando a opção "Reportar abuso".

Saber mais

Esta discussão foi arquivada. Se precisar de ajuda, por favor, coloque uma nova questão.

Apache Log4J Critical Vulnerability

milo.fisk
milo.fisk
more options

Good afternoon,

Is there an impact to the Mozilla Firefox application from the newly discovered Apache Log4J Critical Vulnerability (Log4J version 2.14.1 CVE-2021-44228)?

Can you please confirm if Mozilla Firefox is exposed to this vulnerability and if it is, then do you have an availability date of the patch to your codes?

Thanks, Milo

Good afternoon, Is there an impact to the Mozilla Firefox application from the newly discovered Apache Log4J Critical Vulnerability (Log4J version 2.14.1 CVE-2021-44228)? Can you please confirm if Mozilla Firefox is exposed to this vulnerability and if it is, then do you have an availability date of the patch to your codes? Thanks, Milo

Todas as respostas (3)

Amelia
Amelia
more options

Hello,

I do not believe that this exploit was ever possible (except for java web applets), as Firefox is written in c++ (I believe there is rust in there too)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

This is about a specific Apache application that companies can run to log details about visitors on their servers. Firefox is a web browser and doesn't use this software, so unless you own a website that uses this Apache Log4J software then there is nothing to worry.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 10 Contributor
more options

Hi Milo, if you conduct a search for log4j in the Firefox source code on https://searchfox.org/mozilla-release/source/, you will find that Firefox uses a JavaScript module named log4js. Despite the name similarity, from what I read, it does not have the problematic features of the log4j Java program. Here's what I found:

Let me know if you discover anything concerning.