Zwavejs2mqtt uses log4j - vulnerable to log4shell

dvpfig · December 11, 2021, 2:10pm

Hi,

I noticed that zwavejs2mqtt uses log4j.
How to disable it OR upload to avoid being vulnerable to log4shell?

zmodem · December 12, 2021, 3:36am

I just checked the github repo, searching for log4j doesn’t show any matches. Where are you seeing these references?

blhoward2 · December 12, 2021, 3:39am

No, we do not. Zjs2mqtt is written in JavaScript/TypeScript, not Java. We use the Winston logger.