[Starlingx-discuss] Is there Log4j security vulnerability in Starlingx 5.0?

Jeremy Stanley fungi at yuggoth.org
Tue Jan 11 15:00:52 UTC 2022


On 2022-01-11 14:37:51 +0000 (+0000), Khalil, Ghada wrote:
> Just to clarify, there is no java used in StarlingX.
[...]

That's not quite the same as saying that an installation of
StarlingX will result in no Java on the systems, but I assume it's
what you meant.

The investigation in OpenStack is starting to turn up more corner
cases than just Neutron's support for the Java-based OpenDaylight
service. It's come to light that Kolla will install Elasticsearch if
centralized logging is configured, while Monasca and CloudKitty can
both use Elasticsearch as their storage backend. From your
statement, it sounds like StarlingX deployments make use of none of
those components, so should be unaffected. Thanks again for all the
info!
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20220111/b2a86cc8/attachment.sig>


More information about the Starlingx-discuss mailing list