CVE-2021-44228 - log4j - ¿Discourse vulnerable?

[david (David Taylor)]

Discourse and the Log4j vulnerability

On 9th December, CVE 2021-44228 was published for log4j, a commonly-used Java logging library. Subsequently, CVE-2021-45046 and CVE-2021-45105 have also been published. We’ve received a number of questions about these vulnerabilities, and whether they affect Discourse. Discourse is a Ruby application, and therefore does not make any use of this Java library. In addition, our standard installation instructions for self-hosted installations do not include any Java components. Managed discourse.…