The impact of log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046 for STM32Cube tools has been assessed by the development team, and the tools can be used without risk.
STM32CubeMX,
STM32CubeIDE,
ST-MCU-FINDER-PC
The log4j version used is not impacted by CVE-2021-44228
No risk of remote code execution using CVE-2021-44228
STM32CubeMonitor-RF,
STM32CubeMonitor-UCPD,
STM32CubeMonitor-PWR
The log4j version is impacted by the CVE-2021-44228 (log4j version 2.8.1)
There is no internet and no remote access for this tools, so attacker would have to be logged on the computer and need to have access to tool GUI to inject data in log4j.
No risk of remote code execution using CVE-2021-44228
STM32CubeProgrammer,
STM32CubeMonitor :
log4j is not used for this tools
No risk of remote code execution using CVE-2021-44228
