Systemlink and NI web server - Possible Log4j vulnerability?

[aartjan]

I have SystemLink installed on a PC. It is not so much that I wanted to use SystemLink, but I did need the NI web server, which is a key component within SystemLink.

The NI web server is based on Apache httpd and therefore I fear it might possibly be vulnerable for Log4j exploits.

I have not heard from NI yet on if/how this affects applications built on Systemlink or webservices using the NI web server or even the NI application server.

[JoshuaP]

SystemLink doesn't include any Java-based services or 3rd party components, so it shouldn't be affected.

https://knowledge.ni.com/KnowledgeArticleDetails?id=kA03q000001DtSPCA0&l=en-US

[AustinMan@NI]

@aartjan, the official statement from NI is:

"NI is aware of CVE-2021-44228, which describes a critical vulnerability in Apache log4j. We are currently investigating to determine which, if any, products are affected by this. We will provide additional information as we learn more."

[Sam_Sharp]

@AustinMan@NI

Is there a knowledgebase article link that has that information in it that will be updated once you have concluded your internal investigations? I'd like a statement that covers all NI software e.g. LabVIEW / Drivers / Toolkits for our auditing purposes.

[AustinMan@NI]

@Sam_Sharp The best KnowledgeBase to follow is one that was published yesterday:

https://www.ni.com/en-us/support/documentation/supplemental/21/ni-response-to-apache-log4j-vulnerabi...

[FireflyAutomatix]

Does NI have any updates on this issue?