[Hdmurphy]

Does ProcessMaker 3.5.7 Community have any Log4j vulnerabilities?

[ronrich]

Good morning Hdmurphy,

We understand the concern regarding the Zero-day in the Log4j Java Library and how it affects ProcessMaker, that is the reason why we have escalated the subject to our Security and Engineering Departments.

Engineering confirmed that Log4j is not used in any part of the application nor required to be installed in any of the published supported stacks that use Apache as the webserver, we strongly recommend following the installation steps provided in our wiki page and the server where ProcessMaker is installed is one that hosts ProcessMaker exclusively, if that is the case, then the Zero-day vulnerability won’t affect you.

Best regards.