Skip to content

Instantly share code, notes, and snippets.

@paulgalow

paulgalow/log4j-hotfix-kerio-connect.md

Last active December 26, 2021 15:43
Show Gist options
  • Save paulgalow/3c8c6eac4e7ae76cbdf3ddc2ff12b891 to your computer and use it in GitHub Desktop.
Save paulgalow/3c8c6eac4e7ae76cbdf3ddc2ff12b891 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
log4j-hotfix-kerio-connect.md
🔔 UPDATE
GFI has released an official statement

Log4j hotfix against Log4Shell (CVE-2021-44228) for Kerio Connect server instances running on Ubuntu 20.04. Please note that at this point it is unclear to me if Kerio Connect is vulnerable. This is meant as a precaution.

⚠️ This will remove the vulnerable JndiLookup class from log4j-core-2.5.jar. I haven't run into any side effects, but be advised this might cause unintended side effects.

cd /opt/kerio/mailserver/javaservices/im/lib
systemctl stop kerio-connect.service
tar -cvzf log4j-core-2.5.jar-vulnerable.gz log4j-core-2.5.jar
zip -d log4j-core-2.5.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
systemctl start kerio-connect.service
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment