- Component Type: TYPO3 CMS core & TYPO3 extensions (third-party plugins)
- Release Date: December 16, 2021
- Type: Advisory
- References: CVE-2021-44228, CVE-2021-45046
The critical vulnerability that was recently exposed in the log4j Java library is currently going through the media and some TYPO3 users are unsure whether TYPO3 CMS or TYPO3 extensions are affected by this vulnerability too.
Many TYPO3 websites rely on external services that could be affected by the vulnerability, but only if those external services are based on Java. Here are some common scenarios where additional services are used:
- TYPO3 website includes a website search, which is based on the external services like Apache Solr or Elasticsearch,
- TYPO3 website uses the external service Apache Tika to extract metadata of uploaded files,
- TYPO3 log files are processed by the external service Logstash,
In all these scenarios, the external services are Java-based software components that use the log4j library and are most likely affected by the critical log4j vulnerability.
The TYPO3 Security Team recommends TYPO3 website and server administrators to check if data generated by TYPO3 is logged or processed by Java-based external services in any way. If so, it is important to establish whether the external services use log4j and if they are affected by the vulnerability.
This reference may be a helpful resource for TYPO3 website and server administrators on how to detect and mitigate the log4j/log4shell vulnerability.
Affected components and external services used in the TYPO3 infrastructure have been identified and vendor patches have been applied. Affected components did not include any privacy or account-related data.
Follow the recommendations given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.