function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Jonathan SpinkJonathan Spink 

Does Ant Migration tool have any log4j vulnerabilities?

I think the answer is No, but I haven't seen anything online to confirm this.
AnkaiahAnkaiah (Salesforce Developers) 
Hi Jonathan,

I checked on this with internal team and below are details.

For the protection of your company and other customers, we are not sharing more information at this time.

We appreciate your trust in us as we continue to make your success our top priority. Updates will also be posted to https://status.salesforce.com as additional information becomes available.

The knowledge article will also be updated (see helpful links below)
Apache Logj42 Vulnerability:
https://help.salesforce.com/s/articleView?id=000363736&type=1

Apache Log4j2 post:
https://logging.apache.org/log4j/2.x/index.html

CVE-2021-44228:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

Please note that the investigation and actions taken to remediate are outside of support scope, which limits our ability to answer further questions until a full RCA has been published. In the meantime, we encourage you to monitor the Trust site for updates and to reach out to your account team if you have additional questions regarding impact.

If this helps, please mark it as best answer.

Regards,
Ankaiah Bandi