Forum Discussion
Security Issue with log4j ?
- Dec 15, 2021SQL Server does install log4j, more info here:
https://docs.microsoft.com/en-us/answers/questions/662469/log4j-vulnerability-concerns.html
Carsten2021 , MS SQL Server do not install nor utilize any Java components.
Is it possible, that you have installed a third-party product as extension for SSIS?
https://docs.microsoft.com/en-us/answers/questions/662469/log4j-vulnerability-concerns.html
- Tom_ButlerFeb 23, 2022Copper Contributor
- UjwalaVDec 15, 2021Copper ContributorWill there be any impact if we delete log4j from below directory
Directory: C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars
Is there any way to restore it back (after deleting) and upgrade the log4j version?- ccparkhillDec 15, 2021Copper Contributor
UjwalaV I suppose you could move the file to a different folder and restart SQL Server and see if there's an impact, if there is just move it back and restart again. I'm not sure if you can upgrade it as I presume SQL Server is expecting the version it ships with. Hopefully MS issue a response soon.
- UjwalaVDec 16, 2021Copper Contributor
Thanks ccparkhill
I have already deleted the log4j file as a quick action on the vulnerability. 😞 I had restarted server as well and tested all SSIS packages hosted on it. It was smooth execution. I am wondering if removal of of log4j will have any impact on other areas like, performance or.. ?
Is there any way we can install the higher version of the log4j in the server again? If yes, how it should be?
Thanks