We are using MCSDK 5.3.2 and we have log4j problems. How can I solve them?

[Imen.D]

Hello @ddan.2​ 

You will find a detailed report in this post: STM32Cube tools and log4j

Imen

[ddan.2]

Hi Imen,

The file we are concerned about is "STMicroelectronics\MC_SDK_5.3.2\Utilities\PC_Software\STMCWB\WB_to_Mx\WB_to_Mx.jar", and there is no problem with this file, right?

[ddan.2]

Hi Imen,

We can't use "workbench" right now because of this file.

Is there any update?​

thanks.

[cedric H]

Hello @ddan.2​ ,

What do you mean by "we can't use "workbench" " ?

Do you have some protection tools on your PC that prevent you to run the executable ?

Workbench does not provide any services accessible to the internet, that's why we did not identify any risk of remote code execution using CVE-2021-44228.

Regards

Cedric

[ddan.2]

Hi Cedric

Due to log4j issue, our MIS system detected risk file

"STMicroelectronics\MC_SDK_5.3.2\Utilities\PC_Software\STMCWB\WB_to_Mx\WB_to_Mx.jar",

we have to uninstall "workbance".