Log4j vulnerability in XI and agents

[elade]

Hi,

Dose the Apache Log4j vulnerability is a part of XI, NCPA, NRPE and NSClient?
How can I verify it?
In case of one of the products is using the Log4j vulnerability there is a patch or work around?

[lmiltchev]

https://www.nagios.com/news/2021/12/upd ... erability/

[elade]

Hi lmiltchev,

What about Fusion and the nagios agent NCPA?

[lmiltchev]

Nagios Fusion does not appear to be using vulnerable versions of the products as identified in the MITRE notification. NCPA does not use log4j. NCPA is written in Python, but Log4j is a Java library. NRPE is not affected, either. NSClient++ is NOT one of our products. You can probably find out more information about it on their website.

We recommend using our agent (NCPA) over NRPE and/or NSClient++ as it is actively developed/maintained.

Let me know if you have any further questions. Thank you!