1

RStudio has confirmed that it is not affected by the current log4j / CVE-2021-44228 security issue. However, it has not become clear to me whether there might be any r packages with a log4j dependency. I'm most interested in the tidyverse package and other packages that are broadly used such as the xlsx package.

Here's a discussion on how to detect whether installed r packages have a Java dependency.

Annerose N
  • 477
  • 6
  • 14

2 Answers2

5

Probably not.

The only packages that would a priori be affected would be those that depend — directly or indirectly — on Java components, since the log4j vulnerability itself only affects Java code using the log4j Java pacakge.

Bob Rudis scanned for potential vulnerabilities in packages hosted on CRAN and posted the results on the R-pkg-devel mailing list:

I've scanned all of CRAN with — https://github.com/mergebase/log4j-detector — (and looked for the log4j v2 jar directly) and it's all good […]

The odds of any R environment being impacted by this vulnerability were super slim (to almost none) to begin with and — if the tool is accurate — it's 0.

Konrad Rudolph
  • 530,221
  • 131
  • 937
  • 1,214
0

You can also verify with following script on any installation location:

find . -name '*.jar' | grep -i 'log4j-' | xargs grep 'JndiLookup'

after you identify the jars which are impacted, you can correct with following script:

find . -name 'log4j-core-2.[0-9].*jar' | while read dir;do zip -q -d $dir org/apache/logging/log4j/core/lookup/JndiLookup.class; echo $dir ; done
Konrad Rudolph
  • 530,221
  • 131
  • 937
  • 1,214
ravi shankar
  • 21
  • 2
  • That’ll miss projects which bundle dependencies inside a single JAR (because log4j will be part of a JAR without `log4j` in the name). Still, this is a good, automatic solution for scanning dependencies. One caveat, the second command will break if there’s whitespace or other funny (but legal) characters in the dir name. [Better to use `-print0` with `find` in these situations](https://stackoverflow.com/a/9612232/1968), and then adjust the `read` command accordingly (`IFS= read -r -d ''`.) – Konrad Rudolph Dec 16 '21 at 08:46
  • Thank you Konrad, yes you are right. This works only for jars which are started with log4j, doesn't work even when log4j jars embedded in war file. – ravi shankar Dec 17 '21 at 20:20